That's not really true though. Google serves as an identity provider providing login into 3rd party websites. Plus there's also OAuth prompts when 3rd party services want to use your Google data.
If it's again asking for a password, it must be Google.
Actually, if it is an untrusted URL, I'm not sure why I'd expect that.
Here is the demonstration url from the report https://accounts.google.com/ServiceLogin?service=mail&contin...
My point isn't about 'open redirects' not being a security issue, it's that the report should be valid because it's a whitelist bypass.
continue=yahoo.com is blocked but continue=https://www.google.com/amp/yahoo.com is not blocked.
both do the same thing as far as the end user is concerned.
My guess is that posting this thing on HN has caused them to fix it.
OR maybe I'm being phished.
This is much worse, this is a redirect after login. You just logged into google, you entered your 2FA code, and then the next site you arrive at you damn well expect to be google.
Additionally, the OP is correct in that there is a whitelist bypass happening here. Why bother to whitelist *.google.com/ if you can bypass it with a redirect.