What Are Open Redirects?
An open redirect lets an attacker use your trusted domain to bounce victims to a malicious site. The application takes a destination URL from user input and redirects to it without checking where it points — so a link that starts with your domain quietly ends somewhere hostile. The victim trusts what they see, which is exactly what makes open redirects valuable for phishing.
How does an open redirect work?#
A common pattern is a “return to” parameter after login:
Legitimate: https://trusted.example/login?next=/dashboard
Abused: https://trusted.example/login?next=https://evil.example/phishThe victim sees trusted.example and clicks with confidence; after login, the app forwards them
to the attacker’s look-alike page. Because the initial domain is genuinely trusted — even appearing
in emails and security training — the redirect is disarmingly effective.
Why do low-severity redirects matter?#
Because they are force multipliers for bigger attacks:
| Chained with | Result |
|---|---|
| Phishing | A trusted domain lends credibility |
| OAuth flows | Steal authorization codes/tokens |
| Allowlist filters | Bypass “only our domain” checks |
| SSRF | Redirect a server-side fetch inward |
How do you prevent open redirects?#
- Avoid user-controlled redirect targets entirely where possible.
- Use an allowlist of permitted destinations, or internal path-only redirects.
- Reject absolute URLs to other hosts; only allow relative paths that stay on your site.
Open redirects are an input-validation failure with outsized phishing value. More at the Web Security hub.
Frequently asked questions#
What is an open redirect vulnerability?
An open redirect occurs when an application redirects users to a URL taken from user input without validating it. An attacker crafts a link on your trusted domain that silently forwards the victim to a malicious site. The victim trusts the visible domain, making open redirects a powerful aid to phishing.
Are open redirects really that serious?
On their own they are usually rated low to medium, but they amplify other attacks. They lend a trusted domain to phishing, can bypass some allowlist-based security controls, and are often chained into OAuth token theft and SSRF. A low-severity label understates their usefulness to attackers.