Many applications use inconsistent or custom parameter names to handle post-logout redirection, and this is where open redirect, forced navigation, and privilege-related issues often hide.
Whenever you encounter a /logout, /signout, /endSession, or similar endpoint — fuzz it with this list.
Burp Intruder / Turbo Intruder
/logout?§PARAM§=https://attacker.com