Open Redirect

matrix-synapse is vulnerable to open redirect. The requests to the user provided domains are allowed to external IP addresses while using transitional IPv6 addresses, affecting outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews and allowing to make requests to internal infrastructure on dual-stack networks.