it can bypass some whitelisting if you for example have redirects checking if address is example.com but validation is poorly written ("startswith", "contains")

it can bypass some whitelisting if you for example have redirects checking if address is example.com but validation is poorly written ("startswith", "contains") , on login page or anywhere else.