Impact

If you are not using the confirm_password feature and you are not using the login_return_to_requested_location? or two_factor_auth_return_to_requested_location? configuration methods (the default), there is no impact.

If you are using the confirm_password feature or you are using the login_return_to_requested_location? or two_factor_auth_return_to_requested_location? configuration methods, an attacker who can convince a user to access a path of the attacker's choosing on the application using Rodauth can get Rodauth to redirect to an attacker-chosen protocol-relative URL after completing the action (such as logging in, performing two factor authentication, or confirming their password). Whether this protocol-relative URL will be redirected to depends on factors such as the user's browser.

This does not allow the attacker any access to the application, but it can result in difficult to detect phishing attempts, where the user ends up on an attacker controlled website after going through a legitimate authentication flow in the application using Rodauth.