Open Redirect
Open redirect is a vulnerability where an application redirects users to a URL taken from untrusted input, letting an attacker send victims to a malicious site while starting from a trusted domain. It occurs when a redirect destination is not validated against an allowlist.
An open redirect occurs when an application takes a destination URL from a request parameter (often a redirect, next, or returnUrl field) and sends the user there without validating it. Because the link starts on a trusted domain, an attacker can craft a URL that looks legitimate but redirects the victim to a phishing or malware site, lending credibility to the attack and helping bypass user suspicion and some filters.
Open redirects also amplify other attacks: they can be chained to steal OAuth tokens or leak credentials by bouncing an authenticated flow to an attacker-controlled endpoint. The defense is to never redirect to a raw user-supplied URL — instead map input to a fixed set of allowed destinations, or validate that the target is a relative path or belongs to an allowlisted host before redirecting.
Tracked as CWE-601, open redirect is frequently exploited in phishing campaigns because it borrows the trust of a legitimate domain. Scanners flag redirect calls whose location is derived from untrusted input without validation.