Authenticated open redirect via unvalidated next parameter

Open redirect in SickChill 2024.3.1 and earlier allows remote authenticated users to send victims to attacker-controlled sites. The login handler reads the next query parameter without validating its destination and passes it directly to the redirect call. Valid credentials and active victim interaction are required; the redirect supports phishing but does not directly expose SickChill data.