diff --git a/app/auth/callback/route.ts b/app/auth/callback/route.ts
index b2a5183..f88a7ad 100644
--- a/app/auth/callback/route.ts
+++ b/app/auth/callback/route.ts
@@ -1,10 +1,21 @@
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 
+// Only a same-origin absolute path is an allowed post-login target.
+// Rejects open-redirect vectors: protocol-relative (//evil.com),
+// backslash tricks (/\evil.com), and any scheme/host.
+function safeNext(raw: string | null): string {
+  const fallback = '/dashboard'
+  if (!raw || !raw.startsWith('/') || raw.startsWith('//') || raw.startsWith('/\\')) {
+    return fallback
+  }
+  return raw
+}
+
 export async function GET(request: Request) {
   const { searchParams, origin } = new URL(request.url)
   const code = searchParams.get('code')
-  const next = searchParams.get('next') ?? '/dashboard'
+  const next = safeNext(searchParams.get('next'))
 
   if (code) {
     const supabase = await createClient()