n8n Login Open Redirect

An open redirect vulnerability in n8n's login form that can be exploited for phishing attacks and credential theft.

## Vulnerability Overview
The n8n login page accepts a redirect parameter that is not properly validated. An attacker can craft a URL that, after the user logs in, redirects them to a malicious site. This can be used in phishing campaigns to steal credentials or deliver malware.

## Technical Details
- **Type:** Open Redirect (CWE-601)
- **Root Cause:** The `/login` endpoint accepts a `redirect` query parameter that is used to redirect the user after successful authentication. The parameter is not validated to ensure it points to a local path, allowing redirection to external domains.
- **Exploit URL:** `https://n8n.target.com/login?redirect=https://evil.com/fake-n8n`

## Impact
- Credential phishing via lookalike pages
- Session token theft if the redirect URL captures the authentication cookie
- Social engineering attacks leveraging the trusted n8n domain