CVE-2024-53264: BunkerWeb has Open Redirect Vulnerability in Loading Page

The vulnerability stems from unvalidated use of the 'next' parameter in a redirect. In Go web applications, route handlers typically process request parameters directly. The description explicitly states the loading endpoint uses an unvalidated 'next' parameter, which matches the pattern of a handler function extracting a query parameter and passing it to a redirect function without sanitization. While exact code isn't available, the combination of the vulnerability description, CWE-601 classification, and Go ecosystem patterns strongly suggests the handler function for the /loading route is the vulnerable component.