Browse / Bypasses / URL and redirect validation

Getting past URL and redirect validation

redirect_uri checks, host validation and URL parser differences. 38 disclosed reports got past one.

1. Golden techniques to bypass host validations in Android appsImproper Access Control - Generic · ██████
   278 votes
2. Session Cookie Leakage via Static Header Field in WebViewerFragmentMisconfiguration · high · LinkedIn
   131 votes
3. 1-Click Account Takeover via Open Redirect through Regex Bypass in Domain ValidationImproper Access Control - Generic · critical · Khan Academy
   126 votes
4. Bypassing Digits web authentication's host validation with HPPImproper Authentication - Generic · X / xAI
   108 votes
5. Header modification results in disclosure of Slack infra metadata to unauthorized partiesServer-Side Request Forgery (SSRF) · medium · Slack
   97 votes
6. Bypassing the block of Security Domain Restriction and normally invite blocked domains with special characters “İ”Business Logic Errors · medium · Frontegg
   88 votes
7. OAuth redirect uri validation bypass for :proxima_first_party_sync appsOpen Redirect · high · GitHub
   79 votes
8. Bypass of Open Redirect Fix on lovable.dev via /..// Path Traversal in redirect parameterOpen Redirect · medium · Lovable VDP
   74 votes
9. myshopify.com domain takeoverBusiness Logic Errors · medium · Shopify
   71 votes
10. Bypass Email Verification using Salesforce -- Reproducible in gitlab.comViolation of Secure Design Principles · high · GitLab
    55 votes
11. Bypassing callback_url validation on DigitsOpen Redirect · X / xAI
    48 votes
12. [dev.twitter.com] XSS and Open Redirect Protection BypassCross-site Scripting (XSS) - Generic · medium · X / xAI
    $1,12046 votes
13. SSRF via URL Parser Differential in `normalize_request_url` (wlc)Server-Side Request Forgery (SSRF) · high · Weblate
    43 votes
14. Broken Access Control on **healthwatch.trellix.com** Leading to Unauthorized Access and Sensitive Data ExposureImproper Access Control - Generic · medium · Trellix
    40 votes
15. Open Redirect filter bypass through '\' character via URL parameterOpen Redirect · medium · Myndr
    39 votes
16. urlapi: off-by-one in custom scheme validation skips last characterOff-by-one Error · high · curl
    38 votes
17. SSRF via potential filter bypass with too lax local domain checkingServer-Side Request Forgery (SSRF) · low · Nextcloud
    $25030 votes
18. CVE-2026-3783: token leak with redirect and netrcInformation Exposure Through Sent Data · medium · curl
    26 votes
19. Open redirect in semrush.comOpen Redirect · low · Semrush
    26 votes
20. Open Redirect Protection BypassOpen Redirect · X / xAI
    24 votes
21. Inconsistent URL Parsing in curl Leading to Potential SSRF and Access Control BypassImproper Input Validation · low · curl
    22 votes
22. Incomplete fix for CVE-2022-35406: meta-redirect content-type check bypassable via parameter injectionOpen Redirect · high · PortSwigger Web Security
    18 votes
23. Certificate Hostname Validation Bypass via Leading Dot in HostnameImproper Certificate Validation · medium · curl
    17 votes
24. Bypass the fix of report #1078283 due to poor validationOpen Redirect · high · Khan Academy
    14 votes
25. Stored XSS in the Custom Logo link (non-Basic plan required)Cross-site Scripting (XSS) - Stored · medium · Infogram
    11 votes
26. [H1-2006] CTF WriteupImproper Access Control - Generic · critical · h1-ctf
    10 votes
27. Slack OAuth2 "redirect_uri" Bypass Improper Authentication - Generic · Slack
    10 votes
28. CVE-2022-27780: percent-encoded path separator in URL hostServer-Side Request Forgery (SSRF) · medium · curl
    9 votes
29. Bypass of SSRF VulnerabilityServer-Side Request Forgery (SSRF) · high · Node.js third-party modules
    9 votes
30. Broken Authentication (including Slack OAuth bugs)Violation of Secure Design Principles · Slack
    8 votes
31. inconsistently Rejection Logic in file:// URLs with AuthorityPath Traversal · low · curl
    7 votes
32. Open redirection bypass in /www/admin/campaign-modify.phpOpen Redirect · low · Revive Adserver
    7 votes
33. Redirect FILTER bypass in report/commentOpen Redirect · HackerOne
    $5006 votes
34. libssh backend CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 validation bypassBusiness Logic Errors · low · curl
    4 votes
35. [CTF] I've DDoSed Grinch NetworkUncontrolled Resource Consumption · critical · h1-ctf
    4 votes
36. Open redirect filter bypassOpen Redirect · Zaption
    4 votes
37. Stacked --proto modifiers leave denied protocol enabledlow · curl
    3 votes
38. Open Redirection Security Filter bypassedOpen Redirect · Vimeo
    3 votes