Open redirect
An unvalidated next=, returnUrl, continue=, dest=, url=, or redirect_uri that 302s or JS-navigates to an attacker host. Inventory every one. Do not report it raw unless the program pays P4s; ask what it becomes.
Tags: redirect, ato, oauth, ssrf, xss
Typical severity: P4
What it becomes
Low alone. High when it leaks an OAuth code, a session token, or feeds a server-side fetch.
Where to look
next=return=returnUrlredirectredirect_uricontinue=url=dest=goto=RelayStatecallbacksuccessUrlcancelUrl
Chains
- OAuth / OIDC code leak — Plant the redirect as redirect_uri or as the post-login next= so the IdP or app drops ?code= on your origin.
- XSS — If the sink is location / href and javascript: or data: survives, it is an XSS gadget, not a redirect.
- SSRF — If a backend follows the same parameter (webhooks, PDF, image, link-unfurl), it is server-side.
- Token theft — Password-reset and magic-link flows that bounce through next= leak the token in Referer or the Location chain.
Notes
- javascript: and //evil and /\evil and @evil and \.evil are different parsers. Test all of them.
- A same-site allowlist that uses startsWith or endsWith is still a gadget (https://evil.com/?https://target.com).