Add first vulnerability: Unchecked redirectTo query parameter for login