Submitty up to and including 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt.
rcos submitty