# CVE-2022-45402: Apache Airflow: Open redirect during login

Apache Airflow's /login next parameter accepted /\google.com, bypassing open-redirect filters because browsers parse /\ as // in Location headers.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by (vendor credit): Bugra Eskici
- Found by: bugra
- Disclosed: 2022-12-01
- CVE: CVE-2022-45402
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1782514
- Library page: https://bugbountylibrary.com/r/h1%3A1782514
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:python technique:parser-differential vuln:open-redirect

**Target:** Webserver /login endpoint (next parameter)
**Root cause:** The next parameter's open-redirect validation only checked for leading slashes but did not account for backslash, which browsers normalize to forward slash in Location headers.
**Steps:**
1. Visit `http://127.0.0.1:8080/login/?next=/\google.com`
2. Log in successfully
3. Server issues a redirect to the next value; browser parses `/\google.com` as `//google.com` and navigates to google.com
**How found:** Noticed the next parameter redirects post-login and that existing open-redirect protections existed; hypothesized the filter only handled forward slashes and tried the backslash variant /\google.com, knowing browsers normalize it.
**Exploitation:** Attacker crafts a login URL with next=/\attacker.com and sends it to a victim; after successful login the victim is redirected to the attacker's site for phishing.
**Insight:** When testing open-redirect filters, try backslash variants like /\host — browsers treat \ as / in Location headers, so filters that only block // or :// can be bypassed.