Open redirect: user-controlled redirect target, no validation

What it is

A redirect target — commonly a next, return_to, or redirect_uri parameter — is taken from the request and passed to the redirect without validation.

Why it matters

The link starts on your domain, which is what the victim checks, and lands on the attacker's. It makes phishing considerably more convincing and can leak tokens that ride along in the URL or the referrer.

How to fix it

Accept only relative paths, or match the target against an allow-list of permitted destinations. Reject anything with a scheme or host, including protocol-relative //evil.example values.