Open Redirect Vulnerability

Medium Severity Technical Guide

Vulnerability Description

An open redirect occurs when an application accepts a user-controlled URL as redirect target without validation, allowing attackers to craft phishing links that redirect to external domains.

Remediation Guide

To resolve this vulnerability, follow these config changes or developer practices:

Only redirect to relative URLs or origins contained in a strict domain whitelist. Always present a confirmation screen if redirecting to an external site.

Verify Your Fix

After applying the remediation, run an external attack-surface scan to verify that the vulnerability is no longer detected by WebScanify.

Is your website vulnerable?

Run a free security scan now to identify missing headers, outdated JS, and other deployment vulnerabilities.