Unauthenticated open redirect via unvalidated login destination

Open redirect in Verbb Knock Knock before 1.2.8 allows remote attackers to send users to an attacker-controlled site via a login redirect parameter. The post-login redirect path accepts the form's redirect destination without verifying the signed hash required by Craft CMS. Exploitation requires user interaction with a crafted login link or form; the reported consequence is redirection away from the trusted site.