### Name of the Vulnerable Software and Affected Versions:

Koa (affected versions not specified)

### Description:

The `back` method used for redirect operations in Koa utilizes the user-controllable `Referrer` header as the redirect target, creating an open redirect condition. The `response.redirect()` function, specifically when using the 'back' argument, retrieves the `Referrer` header from the request. If the `Referrer` header is present, the application redirects to the URL specified in this header. If the `Referrer` header is absent, it redirects to the `alt` value or the root path ('/'). This allows an attacker to control the redirect target by manipulating the `Referrer` header.

### Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.