diff --git a/web/oauth.go b/web/oauth.go
index de7763cda9..69a9763317 100644
--- a/web/oauth.go
+++ b/web/oauth.go
@@ -4,6 +4,7 @@
 package web
 
 import (
+	"html"
 	"net/http"
 	"net/url"
 	"path/filepath"
@@ -384,7 +385,7 @@ func mobileLoginWithOAuth(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	redirectURL := r.URL.Query().Get("redirect_to")
+	redirectURL := html.EscapeString(r.URL.Query().Get("redirect_to"))
 
 	if redirectURL != "" && !utils.IsValidMobileAuthRedirectURL(c.App.Config(), redirectURL) {
 		err := model.NewAppError("mobileLoginWithOAuth", "api.invalid_custom_url_scheme", nil, "", http.StatusBadRequest)
diff --git a/web/saml.go b/web/saml.go
index 4e5e5839dd..d7a1fe9161 100644
--- a/web/saml.go
+++ b/web/saml.go
@@ -5,6 +5,7 @@ package web
 
 import (
 	b64 "encoding/base64"
+	"html"
 	"net/http"
 	"strconv"
 	"strings"
@@ -35,7 +36,7 @@ func loginWithSaml(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 	action := r.URL.Query().Get("action")
 	isMobile := action == model.OAUTH_ACTION_MOBILE
-	redirectURL := r.URL.Query().Get("redirect_to")
+	redirectURL := html.EscapeString(r.URL.Query().Get("redirect_to"))
 	relayProps := map[string]string{}
 	relayState := ""