diff --git a/apps/dashboard/src/app/login/isValidEncodedRedirectPath.ts b/apps/dashboard/src/app/login/isValidEncodedRedirectPath.ts
index b74f2375d1f..7c885ebd211 100644
--- a/apps/dashboard/src/app/login/isValidEncodedRedirectPath.ts
+++ b/apps/dashboard/src/app/login/isValidEncodedRedirectPath.ts
@@ -5,7 +5,7 @@ export function isValidEncodedRedirectPath(encodedPath: string): boolean {
       return false;
     }
     const url = new URL(decodedPath, "https://thirdweb.com");
-    return url.hostname === "thirdweb.com";
+    return url.hostname === "thirdweb.com" && !url.pathname.startsWith("//");
   } catch {
     // If decoding fails, return false
     return false;