Open redirect: your domain sending users elsewhere

An open redirect is an endpoint that sends the user to a URL taken from a parameter, without validating it.

https://company.com/go?url=https://evil.com
-> redirects to evil.com, but the shown link is company.com

Why it matters

Alone it seems minor, but: the phishing link starts from your trusted domain (the user trusts it), it bypasses filters that whitelist your host, and above all it amplifies other bugs — in OAuth flows an unvalidated redirect_uri/return-to diverts the authorization code to the attacker.

Defence

Do not pass absolute URLs in parameters. If a return is needed, use a whitelist of relative paths or a map of destinations (id -> url). Validate that the destination is same-origin. In OAuth flows, exact-match the registered redirect_uri.