Next= takes same-origin app paths only; match the invite/branding refusals SecurityService fixed (Identity ID2.4)

Shipped

November 15, 2026 at 8:09 AM UTC

Author

Kamo

Commit

fa7136f

- /validate refused nothing that began with '/', so //host and /\host (and /<tab>/host) left the origin straight after sign-in. app/lib/validateNext.ts: same-origin application paths only; every path accepted before still is. - Invite links: INVALID_INVITE explained; revoke of a link that is already gone (404 NOT_FOUND) says so and reloads. - Sign-In Page section: absent for a member without MANAGE_ORG_BRANDING (403), not an error card. Completes 03ec17802.