#vulns.co
/
mcp by GKData.io

← Back to Gadgets

Open redirect

An unvalidated next=, returnUrl, continue=, dest=, url=, or redirect_uri that 302s or JS-navigates to an attacker host. Inventory every one. Do not report it raw unless the program pays P4s; ask what it becomes.

Tags: redirect, ato, oauth, ssrf, xss

Typical severity: P4

What it becomes

Low alone. High when it leaks an OAuth code, a session token, or feeds a server-side fetch.

Where to look

  • next=
  • return=
  • returnUrl
  • redirect
  • redirect_uri
  • continue=
  • url=
  • dest=
  • goto=
  • RelayState
  • callback
  • successUrl
  • cancelUrl

Chains

  • OAuth / OIDC code leak — Plant the redirect as redirect_uri or as the post-login next= so the IdP or app drops ?code= on your origin.
  • XSS — If the sink is location / href and javascript: or data: survives, it is an XSS gadget, not a redirect.
  • SSRF — If a backend follows the same parameter (webhooks, PDF, image, link-unfurl), it is server-side.
  • Token theft — Password-reset and magic-link flows that bounce through next= leak the token in Referer or the Location chain.

Notes

  • javascript: and //evil and /\evil and @evil and \.evil are different parsers. Test all of them.
  • A same-site allowlist that uses startsWith or endsWith is still a gadget (https://evil.com/?https://target.com).

← Back to Gadgets