PlaceOS Authentication Service prior to 1.29.10.0 allows app/controllers/auth/sessions_controller.rb open redirect.
place placeos authentication