{
  "slug": "open-redirect",
  "url": "https://library.infinity8labs.com/open-redirect/",
  "title": "Open redirect",
  "short": "Open redirect",
  "aliases": [
    "Unvalidated redirect",
    "Unvalidated forward",
    "Arbitrary redirect"
  ],
  "summary": "An open redirect lets untrusted input choose where a trusted application sends the user's browser. It is commonly abused for convincing phishing links and can become more serious when combined with authentication or authorization flows.",
  "cwe": [
    "CWE-601"
  ],
  "owasp": "A01:2021 Broken Access Control",
  "typical_severity": {
    "min": "low",
    "max": "high"
  },
  "updated": "2026-10-15",
  "references": [
    {
      "title": "CWE-601: URL Redirection to Untrusted Site",
      "url": "https://cwe.mitre.org/data/definitions/601.html"
    },
    {
      "title": "OWASP Unvalidated Redirects and Forwards Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Open Redirect",
      "url": "https://community.owasp.org/attacks/open_redirect"
    },
    {
      "title": "OWASP Top 10 A01:2021 Broken Access Control",
      "url": "https://owasp.org/Top10/A01_2021-Broken_Access_Control/"
    }
  ],
  "sections": [
    "https://library.infinity8labs.com/open-redirect/#overview",
    "https://library.infinity8labs.com/open-redirect/#impact",
    "https://library.infinity8labs.com/open-redirect/#examples",
    "https://library.infinity8labs.com/open-redirect/#remediation",
    "https://library.infinity8labs.com/open-redirect/#testing",
    "https://library.infinity8labs.com/open-redirect/#references"
  ]
}