Open Redirect
Medium · Access Control
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-601
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-601
Definition
App redirects users to attacker-chosen URLs.
Root cause
Unvalidated redirect parameters.
Affected components
- Components in the “Access Control” class
- Application / API handlers
- Supporting libraries
Impact
Phishing via trusted domain.
Severity
Medium
Safe lab reproduction
PortSwigger open redirect
Detection methodology
Redirect param fuzzing.
Evidence examples
- Lab reproduction notes: PortSwigger open redirect
- Request/response excerpts (redacted)
- Detection signal: Redirect param fuzzing
Remediation
Allow-list destinations; avoid user-controlled redirects.
Secure coding examples
Map IDs to internal routes instead of raw URLs.
Related CYNARKS lessons & labs
Tools: burp
Practise related skills in Labs or deepen on Academy library.