Open redirection (reflected)
Summary: Open redirection vulnerabilities arise when an application incorporates user-controllable data into a redirection target in an unsafe way, letting an attacker construct a URL within the application that redirects to an arbitrary external domain. PortSwigger notes this can be leveraged for phishing because the authentic application URL, correct domain, and valid SSL certificate lend credibility that many users will not question even if they check those features.
What's compelling: The attack borrows your domain and your valid SSL certificate as its cover, so users who do verify the URL still land on an attacker's site - and PortSwigger's guidance is simply to keep user-controllable data out of redirection targets wherever possible.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026