CyberGuard dictionary / Web Application Security
Open Redirect
An open redirect lets an attacker choose an untrusted destination for a link or redirect served by a legitimate site.
In simple terms
A familiar website address sends a visitor to a different site selected by someone else.
Technical explanation
The application may accept a destination parameter and redirect without restricting it. Prefer fixed destinations or a strict allowlist, normalize and validate URLs carefully, and avoid trusting lookalike hostnames or partial string matches.
A redirect endpoint can make an attacker-controlled destination appear behind a trusted domain. Validation should resolve the final destination and avoid loose prefix or substring matching.
Examples in practice
A phishing message links to a trusted site's login redirect endpoint, which forwards the visitor to an attacker-controlled page.
An attacker sends a link beginning with the company's genuine domain that forwards to a fake sign-in page. The company replaces free-form destinations with approved internal routes.
Why it matters
The trusted domain can make phishing links more convincing and may disrupt security flows.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.