A bug in the login redirect route allows authenticated users to craft URLs that bypass the `is safe url` check. This enables the redirection of users from a trusted Airflow domain to an origin controlled by an attacker. The issue involves the `next=` query parameter.