Nimbus SSO login. Any username/password issues a signed session and then sends you to next - a parameter redirected to without any allow-list. Point next at an attacker origin and the login will forward the fresh session token in the URL. Then take that token to the collect endpoint to prove account theft.
Attacker collect endpoint: /naked/openredirect-to-token/collect?token=<stolen token>.