diff --git a/app/(auth)/login/actions.ts b/app/(auth)/login/actions.ts
index 0288193..191391f 100644
--- a/app/(auth)/login/actions.ts
+++ b/app/(auth)/login/actions.ts
@@ -5,8 +5,20 @@ import { redirect } from "next/navigation";
 
 import { signIn } from "@/auth";
 
+function sanitizeCallbackUrl(raw: string): string {
+  try {
+    const parsed = new URL(raw, "http://x");
+    if (parsed.origin !== "http://x") return "/";
+  } catch {
+    return "/";
+  }
+  return raw.startsWith("/") ? raw : "/";
+}
+
 export async function loginAction(formData: FormData) {
-  const callbackUrl = String(formData.get("callbackUrl") ?? "/");
+  const callbackUrl = sanitizeCallbackUrl(
+    String(formData.get("callbackUrl") ?? "/")
+  );
 
   try {
     await signIn("credentials", {