I’m not sure it’s the same, but this reminds of of ?auth-u automatically added to destination path where extraneous characters were added, and you have roughly the right number of them, and then they end. The suspect code is shown, but I forget if an issue was filed. Feel free if you have steps to reproduce it.