Version 4.3.6

system/Login/LoginAbstract.php

@@ -75,7 +75,7 @@ abstract class _LoginAbstract extends \IPS\Login\Handler
 			try
 			{
 				$url = \IPS\Http\Url::createFromString( base64_decode( \IPS\Request::i()->ref ) );
-				if ( $url instanceof \IPS\Http\Url\Internal )
+				if ( $url instanceof \IPS\Http\Url\Internal and !$url->openRedirect() )
 				{
 					$destination = $url;
 				}