Open Redirect

Endpoint that forwards users to any URL supplied in a parameter, weaponising the site's own trust.

Specifications & Metrics

cwe

CWE-601

impact

Medium

Core Principles & Analysis

• Phishing links ride a legitimate domain: yourbank.com/redirect?url=evil.example.
• Also serves as an OAuth token-capture stepping stone.
• Fix is a server-side allowlist of redirect targets.