diff --git a/routes/index.js b/routes/index.js
index 6b5455f03e4..346bf93c6d2 100644
--- a/routes/index.js
+++ b/routes/index.js
@@ -51,13 +51,23 @@ exports.loginHandler = function (req, res, next) {
   }
 };
 
+function isSafeRedirectUrl(url) {
+  if (typeof url !== 'string') return false;
+  if (!url.startsWith('/')) return false;
+  if (url.startsWith('//')) return false;
+  if (url.startsWith('/\\')) return false;
+  if (url.includes('://')) return false;
+  if (/[\\\r\n]/.test(url)) return false;
+  return true;
+}
+
 function adminLoginSuccess(redirectPage, session, username, res) {
   session.loggedIn = 1
 
   // Log the login action for audit
   console.log(`User logged in: ${username}`)
 
-  if (redirectPage) {
+  if (redirectPage && isSafeRedirectUrl(redirectPage)) {
       return res.redirect(redirectPage)
   } else {
       return res.redirect('/admin')