/orders
The post-checkout ?next= redirect is followed as-is - point it off-site (?next=https://evil.example) for an open redirect.
?next=
?next=https://evil.example