[skirge]

it can bypass some whitelisting if you for example have redirects checking if address is example.com but validation is poorly written ("startswith", "contains") , on login page or anywhere else.