From 56f8910059243dfab72bc626c9a2a746797957b0 Mon Sep 17 00:00:00 2001
From: 0xFirekeeper <0xFirekeeper@gmail.com>
Date: Mon, 12 Oct 2026 16:13:46 +0700
Subject: [PATCH] [Dashboard] Tighten login redirect path validation

---
 apps/dashboard/src/app/login/isValidEncodedRedirectPath.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/dashboard/src/app/login/isValidEncodedRedirectPath.ts b/apps/dashboard/src/app/login/isValidEncodedRedirectPath.ts
index b74f2375d1f..7c885ebd211 100644
--- a/apps/dashboard/src/app/login/isValidEncodedRedirectPath.ts
+++ b/apps/dashboard/src/app/login/isValidEncodedRedirectPath.ts
@@ -5,7 +5,7 @@ export function isValidEncodedRedirectPath(encodedPath: string): boolean {
       return false;
     }
     const url = new URL(decodedPath, "https://thirdweb.com");
-    return url.hostname === "thirdweb.com";
+    return url.hostname === "thirdweb.com" && !url.pathname.startsWith("//");
   } catch {
     // If decoding fails, return false
     return false;