diff --git a/packages/twenty-front/src/modules/auth/utils/__tests__/isValidReturnToPath.test.ts b/packages/twenty-front/src/modules/auth/utils/__tests__/isValidReturnToPath.test.ts
index 54f84c12a8..fbc9f8e39b 100644
--- a/packages/twenty-front/src/modules/auth/utils/__tests__/isValidReturnToPath.test.ts
+++ b/packages/twenty-front/src/modules/auth/utils/__tests__/isValidReturnToPath.test.ts
@@ -17,6 +17,12 @@ describe('isValidReturnToPath', () => {
     expect(isValidReturnToPath('//evil.com')).toBe(false);
   });
 
+  it('should return false for backslash-tricked paths', () => {
+    expect(isValidReturnToPath('/\\evil.com')).toBe(false);
+    expect(isValidReturnToPath('/\\/evil.com')).toBe(false);
+    expect(isValidReturnToPath('/objects\\..\\evil')).toBe(false);
+  });
+
   it('should return false for onboarding paths', () => {
     expect(isValidReturnToPath('/create/workspace')).toBe(false);
     expect(isValidReturnToPath('/create/profile')).toBe(false);
diff --git a/packages/twenty-front/src/modules/auth/utils/isValidReturnToPath.ts b/packages/twenty-front/src/modules/auth/utils/isValidReturnToPath.ts
index 67fa1db958..e3fadb322b 100644
--- a/packages/twenty-front/src/modules/auth/utils/isValidReturnToPath.ts
+++ b/packages/twenty-front/src/modules/auth/utils/isValidReturnToPath.ts
@@ -16,7 +16,7 @@ export const isValidReturnToPath = (path: string): boolean => {
     return false;
   }
 
-  if (!path.startsWith('/') || path.startsWith('//')) {
+  if (!path.startsWith('/') || path.startsWith('//') || path.includes('\\')) {
     return false;
   }