GHSA-jqxr-vjvv-899m @keystone-6/auth Open Redirect vulnerability

• npm @keystone-6/auth: < 7.0.0 → fixed in 7.0.0

Summary There is an open redirect in the `@keystone-6/auth` package, where the redirect leading `/` filter can be bypassed. Impact Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location. Mitigations • Don't use the `@keystone-6/auth` package References • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') • OWASP: Unvalidated Redirects and Forwards Cheat Sheet Similar Vulnerability Reports • CVE-2023-0748 • CVE-2022-2252 Credits Thanks to morioka12 for reporting this problem. If you have any questions around this security advisory, please don't hesitate to contact us at [email protected], or open an issue on GitHub. If you have a security flaw to report for any software in this repository, please see our SECURITY policy.