Developer Ships Second Open Redirect Bug in the Same Fix Meant to Patch the First

A developer maintaining the CAS-Authentication-User npm package discovered a second open redirect vulnerability in version 0.3.0, the very release that was meant to fix a previously identified flaw. The new guard function, isSafeReturnTo, correctly rejected malicious returnTo query parameters, but when it fell back to the request path as a default, it inadvertently constructed the same type of protocol-relative URL it was designed to block. The root cause was a modelling error: the request path, though fully controlled by an attacker, was treated as a trusted internal fact rather than as user input requiring validation. Unlike the first bug, this variant required no returnTo parameter, no service ticket, and no CAS server involvement, making it easier to exploit against authenticated users. The developer has since identified the actual sink — the res.redirect calls in index.js — as the correct place to enforce validation, rather than only auditing obvious query string inputs.