diff --git a/src/Readarr.Http/Authentication/AuthenticationController.cs b/src/Readarr.Http/Authentication/AuthenticationController.cs
index 64def970f..c1477e2a6 100644
--- a/src/Readarr.Http/Authentication/AuthenticationController.cs
+++ b/src/Readarr.Http/Authentication/AuthenticationController.cs
@@ -47,7 +47,7 @@ namespace Readarr.Http.Authentication
 
             await HttpContext.SignInAsync(AuthenticationType.Forms.ToString(), new ClaimsPrincipal(new ClaimsIdentity(claims, "Cookies", "user", "identifier")), authProperties);
 
-            if (returnUrl.IsNullOrWhiteSpace())
+            if (returnUrl.IsNullOrWhiteSpace() || !Url.IsLocalUrl(returnUrl))
             {
                 return Redirect(_configFileProvider.UrlBase + "/");
             }