The URL parameter next at /[channel]/[locale]/account/login/ in react-storefront has an open-redirect vulnerability which could be used to trick the user into disclosing sensitive information using phishing attacks or social engineering
tactics.

Patches

• c29aab2

Workarounds

We recommend upgrading to the latest version as soon as possible. If unable, possible workarounds are:

• Drop the next parameter from login page (e.g. WAFs)

References

• https://huntr.dev/bounties/9d308ebb-4289-411f-ac22-990383d98932/