Problem confirmed.

An access denied error should be displayed instead of redirecting.

@PR_CSO I'm going to open a security advisory on Github for this and get a CVE assigned. Let me know if you would like to be credited for the finding, and if so, how you want your name to appear.

@PR_CSO If you give me know your GitHub account, I can add you to the Advisory, so you can review and test the fix.

My github username is jeky--
I am not interested in any credits on the CVE.

Thanks

I added you (jeky--) as collaborator on the advisory, you should have received a notification.

I'll push the fix ASAP - hopefully later tonight.

CVE-2023-44394 assigned.

@PR_CSO testing and feedback on the patch would be appreciated (here, or preferably in the pull request)

GitHub advisory published