← All articles

Open Redirect Vulnerability and Its Phishing Risk

23 September 2026

Open Redirect Vulnerability and Its Phishing Risk

An Open Redirect is when an application redirects a user to an address the user controls, without validation. It does not leak data on its own; instead it rents out your site’s trustworthiness to attackers: the victim clicks a familiar domain (yours) but lands on the attacker’s site. That is why it is common in phishing campaigns.

How it arises

Applications often carry a “where do we return?” parameter: post-login redirects, “continue” links, logout flows. For example:

https://yoursite.com/login?next=/dashboard

If the application redirects to the next value without validation, the attacker can point it to an external address:

https://yoursite.com/login?next=https://fake-yoursite.example/login

The victim trusts the yoursite.com link and clicks; after login (or directly) they are redirected to the attacker’s pixel-perfect fake login page, where they enter their credentials.

Why it is dangerous

  • Trust transfer: email filters and users trust the familiar domain; the link genuinely starts with your domain, so suspicion drops.
  • It gets worse in OAuth/token flows: if the redirect target carries a token or code, open redirect can leak those sensitive values to the attacker.

Prevention

  1. Restrict outbound redirects with an allowlist. Allow only your own paths (relative, like /dashboard) or pre-approved domains.
  2. Do not use the raw user URL as the redirect target. Where possible, map the target to an identifier (a fixed page key) instead of a full URL.
  3. Resolve relative paths correctly. Ensure protocol-relative values like //fake.example do not escape outward; checking only “does it start with http?” is insufficient.
  4. If you must redirect externally, an explicit “you are leaving this site” interstitial warns the user.

Summary

Open redirect lends your site’s address-bar trust to attackers and eases phishing. The fix is clear: restrict redirect targets with an allowlist, do not use the raw user URL as a target, and resolve paths correctly against protocol-relative bypasses.

Sources: OWASP Unvalidated Redirects and Forwards Cheat Sheet, CWE-601.

Are the redirect parameters on your site exposed to open redirect? CyberTestify’s scan assesses this on discovered entry points.