I found a website that has the parameter
post_login_redirect= I can change to any existing and non-exisiting subdomains, but there is no possibility to redirect to another domain. The redirect occurs after the user logs in.
sub.domain.com and we can change to anything if we respect the
domain.com. so we can redirect to
a.b.c.b.domain.com even if that subdomain doesn't exist, it will redirect anyway. But we can't redirect to
This is not an open redirect issue, because we can only redirect to subdomains that we don't own.
Is there any possibility to chain this or make this a real vulnerability?