An open redirect, also called an unvalidated redirect, is a security vulnerability where an application sends users to an address taken from user input without checking that it is a safe destination. It usually appears in parameters such as next, return or url that tell the application where to go after login, logout or a form submission.
Why it matters: Open redirects are a favourite tool for phishing. A link that starts with a trusted domain looks safe, so people click it, then land on a lookalike site that asks for their password. Open redirects can also be chained with other weaknesses, such as SSRF or flawed single sign-on flows, to cause more serious problems.
In practice: Testers find every parameter or field that controls where the user ends up next. They then replace the expected path with an external domain and check whether the browser lands there after the action completes. Useful variants include protocol-relative values starting with //, values starting with /\ that some browsers treat as external, and encoded forms that may slip past simple validation.
Examples:
- A login page with a next parameter sends the user to an external domain after a successful sign-in.
- A logout link accepts //example.org as its return value and drops the user on a site outside the application.
- A redirect check that only confirms the value starts with a slash is bypassed by a value starting with /\.
Common pitfalls:
- Validating only that the value contains the company domain, which an attacker can satisfy with a subdomain they control.
- Testing only the visible redirect after login and missing redirect parameters in logout, error and email confirmation flows.
Is an open redirect a serious vulnerability? On its own it is often rated low to medium, because it needs a user to click a crafted link. Its real risk comes from making phishing more convincing and from being combined with other flaws.
