Severity: Critical
CVSS Score: 9.8
The referrer URL used by MFA required additional sanitizing, rather than being used directly.