Open redirect vulnerabilities
An open redirect happens when an application sends users to a URL taken from a parameter, such as ?next= or ?returnUrl=, without checking it. It looks minor, but attackers use it to make phishing links look trustworthy, and it can help steal OAuth tokens.
How it happens
The attacker sends a link that starts with your real domain but redirects to theirs, for example after login. Victims see a familiar domain and trust it. In OAuth flows, a weak redirect check can leak authorization codes or tokens to the attacker.
Why it matters
- Convincing phishing campaigns that abuse your brand.
- Theft of OAuth codes and tokens.
- Bypass of URL allow-lists in other security controls.
How to prevent it
- Redirect only to relative paths, or to an allow-list of known destinations.
- Map short IDs to destinations on the server instead of accepting full URLs.
- Validate OAuth redirect URIs with exact matching.
How Vooki Pro helps
- Tests redirect parameters for open redirects.
- Checks OAuth and OIDC flows, including redirect URI validation, the state parameter, PKCE and code theft.
- Includes the finding in compliance reports mapped to OWASP Top 10.
- Lets you retest after the fix with one click.
Frequently asked questions
Is an open redirect a serious vulnerability?
On its own it is often rated low, but it makes phishing far more convincing and can be chained with OAuth flaws to steal tokens.
How do I fix an open redirect?
Redirect only to relative paths or an allow-list of destinations, or map short IDs to URLs on the server.
Try Vooki Pro free for 7 days
Stop attackers from borrowing your domain for phishing. The trial unlocks every feature for 7 days, and scanning runs on your own machine.
Related: HTTP request smuggling · CORS misconfiguration