There is a security Vuln in the signup.php and login.php
$next is not properly filtered against XSS.

Admin i have PMed you the Proof of Concept. (exploit)