We are running into an issue with our customer account extension. It appears to be recent and we currently know of only one store that brought this up but redirecting from within customer account extensions outside triggers a customer authentication flow after completing authentication however the original path that we were redirecting only retains it’s first param. The examples below will make the issue clear.
The SSO redirect triggers you can see that it has a return_to param but it’s not correctly handling the path inside:
After authentication the return_to only sends the first param and removes any others as it assumes the return_to terminated at the the first & inside the path:
