TIDES-2026-001mediumCVSS 6.3

Intake accepted an untrusted return destination

From March 18 through July 10, 2026, the authenticated client intake flow accepted an unvalidated return destination and passed it to client-side navigation after intake completion. A crafted link could cause unintended navigation or, for an unsafe URL scheme, script execution in the page context. Tides found no evidence of exploitation, affected accounts, or customer impact.

Published Jul 31, 2026 · Last updated Jul 31, 2026

Affected surfaces

Authenticated client intake completion flow (/intake)
Client-side return-destination handling in app/(client)/intake/page.tsx

Affected period

March 18, 2026 through July 10, 2026

Impact

Successful exploitation required a client to open a crafted Tides intake link and complete or continue from the intake flow. The issue could redirect the client to an unintended destination, support phishing, or execute script in the authenticated page context when an unsafe URL scheme was supplied. Tides found no evidence that the issue was exploited, and no affected accounts or customer data exposure were identified.

Remediation

On July 10, 2026, Tides deployed shared return-destination validation across the intake, sign-in, and registration flows. The validator accepts only application-local absolute paths and rejects external URLs, protocol-relative URLs, backslashes, encoded path separators, control characters, and unsafe URL schemes. Invalid destinations now return the client to a safe application page. Automated regression coverage verifies both valid local destinations and hostile inputs.

Customer action

No action is required. The issue was fixed on July 10, 2026. Customers who observed unusual navigation after completing intake before that date may contact security@mail.tidespilates.com.

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Acknowledgments

Tides Pilates internal security review