diff --git a/VERSION b/VERSION
index e1bfa671..1e9bc0d6 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-Version 2.6.0-development+timestamp.2013.07.23.01.03.38
+Version 2.6.0-development+timestamp.2013.07.23.02.04.35
diff --git a/gluon/tools.py b/gluon/tools.py
index 59747ce6..dced42c2 100644
--- a/gluon/tools.py
+++ b/gluon/tools.py
@@ -2046,7 +2046,12 @@ class Auth(object):
         ### pass
 
         if next is DEFAULT:
-            next = self.next or self.settings.login_next
+            # important for security
+            next = self.settings.login_next
+            if self.next:
+                host = self.next.split('//',1)[-1].split('/')[0]
+                if host in self.settings.cas_domains:
+                    next = self.next
         if onvalidation is DEFAULT:
             onvalidation = self.settings.login_onvalidation
         if onaccept is DEFAULT: