{
  "id": 7935905,
  "title": "An Open Redirect Guard That Rebuilt What It Rejected",
  "url": "https://urgent.news/2026/09/17/an-open-redirect-guard-that-rebuilt-what-it-rejected",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-17T03:00:00.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/megapixel99/an-open-redirect-guard-that-rebuilt-what-it-rejected-m30"
  },
  "original_language": "en",
  "account": "In a recent incident, security researcher Megapixel99 discovered two open redirects in the npm package CAS-Authentication-User. The vulnerable code accepted user input and directed it to a destination without proper validation. A second open redirect was found shortly after the initial fix, bringing the total to two. The package was vulnerable because the sink, or the point where user input was used, was not adequately checked, allowing attackers to redirect users to malicious sites. The fix in version 0.4.0 improved the situation by using the WHATWG URL API to parse request URLs, which resolved any issues with bad URLs. This change ensured that only legitimate paths were accepted, effectively closing the vulnerability.",
  "summary": "Code: Megapixel99/CAS-Authentication-User Eight days ago I wrote that npm audit had never seen the worst bug in my own package. I closed that post on the question I thought would have caught it: given that nobody has audited this code, what would I find if I read the places where it hands user input to something that acts on it. I asked it, I found an open redirect on the login route, and 0.3.0…",
  "key_points": [
    "Two open redirects discovered in CAS-Authentication-User npm package",
    "Fix in version 0.4.0 improved security using WHATWG URL API",
    "Vulnerability resolved by validating user input and rejecting malicious paths"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}