The WS-Federation provider in this open-source identity provider validates the user-supplied `wreply` parameter using a raw string prefix check instead of proper URL parsing. An attacker can craft a login link with a `wreply` value from a different origin that bypasses this check, leading the victim's browser to POST the signed WS-Federation login response to infrastructure controlled by the attacker.