Post-login phishing redirect via unvalidated destination

Open redirect in FireEye HXTool 4.6 allows remote attackers to send users to a malicious page through a crafted redirect_uri parameter. The login handler reads redirect_uri from the query string and passes it directly to Flask's redirect function after successful authentication, without validating the destination. A victim must follow the crafted link and successfully sign in before the server returns the attacker-controlled redirect, enabling phishing through a trusted HXTool origin.