An Open Redirect occurs when an application accepts a user-supplied URL parameter and redirects to it without proper validation. Attackers can exploit this by crafting malicious links that appear to originate from a trusted domain but silently forward the victim to an attacker-controlled site. This is often leveraged for phishing, credential theft, or chaining into more severe exploits such as token leakage or XSS.

Remediation

• Enforce an allowlist of trusted redirect destinations; reject or normalise all other values.
• Use relative paths for internal navigation instead of absolute URLs provided by user input.
• Where dynamic redirects are unavoidable, validate that the supplied URL shares the same origin/domain as the application.
• Encode redirect parameters and avoid reflecting user-controlled values directly in `Location` headers without checks.