Open redirect
A link on your own site sends visitors wherever a parameter says, as in /login?next=... An attacker sends a link that starts with your trusted address and ends on theirs, ready for a convincing fake page.
The check looks easy and has many ways round it. //evil.example has no scheme but still leaves your site, and so does a backslash in some positions, because browsers read addresses differently from how a string comparison does.
Say it to your agent
“Parse next with new URL against our own origin, allow only same-origin or hosts on the allowlist, and fall back to /. Test //evil.example, /\evil.example, https://shop.example@evil.example and javascript:alert(1). Don't use startsWith.”