Open Redirect
Escape allow-list redirect validation. Low impact alone, but chains into OAuth token theft and SSRF filter bypass. Test on redirect_uri, next, returnUrl, url, and dest params.
Tags: open-redirect, oauth, chain
Controlled probes
//evil.comhttps:evil.com/\evil.comhttps://target.com@evil.comhttps://evil.com%2f%2f.target.com//evil.com/%2f..javascript:alert(document.domain)
Source: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open%20Redirect