Authenticated open redirect via unvalidated redirect_url

Open redirect in xuxueli XXL-SSO 1.1.0 allows remote authenticated users to send victims to attacker-controlled sites. WebController accepts redirect_url from the doLogin and login requests, appends the session identifier, and returns the resulting value as a redirect without validating its destination. Successful login or an existing authenticated session is required, and exploitation depends on a victim following the crafted flow; the redirect can support phishing and exposes the session identifier to the chosen site.