Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| Serenity.Net.Core(NuGet) | 0 | 6.8.0 | N/A |
| @serenity-is/corelib(npm) | 0 | 6.8.0 | N/A |
CVSS Metrics
