Turns out any URL provided in the next value will be followed automatically, so this is an open redirect (duplicate of bug 1865026).
Turns out any URL provided in the next value will be followed automatically, so this is an open redirect (duplicate of bug 1865026).