Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt.
mitre·CWE-601·Published 2020-05-16