Server-controlled `__next` URL is not checking cross-origin (CVE-2026-66773) | HOL Guard CVE