Open redirection (reflected DOM-based)
Summary: PortSwigger describes reflected DOM-based open redirection, which occurs when data from a request is echoed into the immediate response in a part of the DOM that a client-side script then processes unsafely, and a script writes controllable data into a redirection target. The write-up notes an attacker can build a URL that redirects another user to an arbitrary external domain, and that controlling the start of the string passed to the redirection API may escalate the flaw to JavaScript injection via the javascript: pseudo-protocol.
Bottom line: An authentic application URL with a valid SSL certificate lends credibility to a phishing link, because many users who check those features will not notice the subsequent redirect to a different domain.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026