User redirection via crafted login URL

Open redirect in Icinga Web 2 before 2.11.5 and 2.12.0 through 2.12.2 allows remote authenticated users to redirect visitors. The login flow accepts an attacker-controlled destination from a crafted URL and returns a redirect to that arbitrary location; the vendor has not identified the responsible parameter or handler. Exploitation requires a victim who is authenticated or can authenticate to visit the link, after which the browser leaves the trusted origin for attacker-chosen content.