Open redirect chains
An unvalidated next= is inventory, not a report, until it leaks an OAuth code, a session token, or feeds a server-side fetch.
Skill
No skill is linked for this class yet. Start with the playbook on this page.
Checklists
None linked for this class yet.
Disclosures
No public card yet.
Gadgets
- Open redirect - Low alone. High when it leaks an OAuth code, a session token, or feeds a server-side fetch.
Playbooks
- Open Redirect Chains - Do not report the bounce. Report where the victim's code, token, or script execution goes.
Payloads
- Open Redirect - Escape allow-list redirect validation. Low impact alone, but chains into OAuth token theft and SSRF filter bypass. Test on redirect_uri, next, returnUrl, url, and dest params.
Questions
Will programs pay for a bare redirect?
Some pay P4/P5. Most want the chain: OAuth code, reset token, or SSRF. Ask what it becomes.
Which parsers?
javascript:, //evil, /\evil, @evil, and startsWith allowlists are different bugs. Test all of them.
This page is the linked pack hunt_brief("redirect") returns on the MCP connector. Authorized testing only.