thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Open Redirect

A flaw where an application redirects users to a URL supplied in a parameter without validation.

Definition

Open redirects lend a trusted domain's credibility to phishing links and can help bypass SSRF filters or steal OAuth tokens. Mitigations include avoiding user-controlled redirect targets, using server-side mapping IDs, or allowlisting destinations. Tracked as CWE-601.

Example

https://bank.example/login?next=https://evil.example sends victims to a lookalike site after login.

Exam tip

Allowlist redirect destinations or use indirect references.

Related terms