Open Redirect
Medium · Access Control · CWE-601
Description
App redirects users to attacker-chosen URLs.
Root cause
Unvalidated redirect parameters.
Impact
Phishing via trusted domain.
Detection
Redirect param fuzzing.
Mitigation
Allow-list destinations; avoid user-controlled redirects.
Secure coding
Map IDs to internal routes instead of raw URLs.
Safe lab example
PortSwigger open redirect
Practise related skills in Labs or deepen on Academy library.