Description

The endpoint of login allows Javascript payload to execute which leads to XSS pop-up

Proof of Concept

Send this link to admin http://127.0.0.1:2222/login/?redirect=javascript:alert(document.cookie)

When he will open it and try to login XSS will popup.

Image POC

https://drive.google.com/file/d/1VoO0BHUE03o0iOo8B9WFRvC1zRrFN4-T/view?usp=sharing