Catalog/VULNERABILITY/open-redirect
SCAN-ID: OPEN-REDIRECTREVISION 2026.4
VULNERABILITYCVSS 8.3 (HIGH)

Open Redirect & SSRF Probe

Find unvalidated destination redirects and server-side request forgery endpoints querying internal networks.

Technical Scope & Verification Behavior

Tests query parameters (?returnUrl=, ?dest=, ?url=) with external protocol schemes, cloud metadata addresses (169.254.169.254), and localhost loopbacks.

Automated Inspection Checks (14)
Passive URL parameter fuzzing
Non-destructive boundary tests
Header & cookie flag assertions
Differential latency timing

Proof of Concept (PoC) Vector

Canonical test payload dispatched during security surface audits.

/login?redirect=https://phishing-site.com/auth

Probe Execution Simulator

Watch the probe engine test this signature in an isolated sandbox.

probe-runner (isolated ephemeral container)
Click 'Simulate Check' to watch the headless audit engine test this vector.

Remediation Patch

Relative URL Validation

patch.diff (typescript)
--- a/handler.typescript (Vulnerable)
res.redirect(req.query.redirectUrl);
+++ b/handler.typescript (Remediated)
const url = req.query.redirectUrl;
if (url.startsWith('/') && !url.startsWith('//')) {
  res.redirect(url);
} else { res.redirect('/dashboard'); }

Ensure redirection destinations are strictly validated as internal relative paths or checked against trusted domain whitelists.

AI Agent Prompt (Cursor · Claude · Copilot)

Copy and paste into your editor to refactor this issue automatically.

"Validate that the redirect query parameter is an absolute path starting with / and not containing protocol schemes."

Run Isolated Check

Test your public domain specifically for Open Redirect & SSRF Probe.

100% passive • No server load

Specification Details

CVSS Score
8.3 / 10.0
Severity Level
HIGH
Category
VULNERABILITY
Test Vectors
14 automated
Execution SLA
< 2.5 seconds
False Positive Defense
Strict assertion
Related Standards
#SSRF#Redirect#OWASP A10

Run continuous monitoring for Open Redirect & SSRF Probe

Audit your site across all 41 vectors automatically on every deploy.

Back to Catalog