[Buge]

It's an open redirect, not XSS. It's a matter of debate whether an open redirect is a vulnerability or not.