Browse / Open Redirect

Open Redirect

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Open Redirect357

Often found together with

• Cross-site Scripting48

Most upvoted Open Redirect reports

AllValidInformativeN/ADuplicate

1. XSS and Open Redirect on MoPub LoginOpen Redirect · X / xAI
   $1,540248 votes
2. Open Redirect in secure.showmax.comOpen Redirect · Showmax
   $550225 votes
3. [PayPal Android] Remote theft of user session using push_notification_webview deeplinkOpen Redirect · medium · PayPal
   188 votes
4. Open redirect at https://inventory.upserve.com/http://google.com/Open Redirect · medium · Upserve
   $1,200179 votes
5. Open Redirect in Logout & LoginOpen Redirect · medium · Expedia Group Bug Bounty
   171 votes
6. [Venmo Android] Remote theft of user sessionOpen Redirect · medium · PayPal
   151 votes
7. Open redirect due to scanning QR code via brave browserOpen Redirect · high · Brave Software
   148 votes
8. Open redirectSpamOpen Redirect · XVIDEOS
   143 votes
9. Open URL RedirectionOpen Redirect · medium · Unikrn
   102 votes
10. Open redirect vulnerabilityOpen Redirect · low · Rockstar Games
    $25083 votes
11. Open redirectOpen Redirect · Nord Security
    81 votes
12. OAuth redirect uri validation bypass for :proxima_first_party_sync appsOpen Redirect · high · GitHub
    79 votes
13. another liberapay member team twitter account broken Link Hijacking via Expired Twitter Account LinkInformativeOpen Redirect · Liberapay
    77 votes
14. Bypass of Open Redirect Fix on lovable.dev via /..// Path Traversal in redirect parameterOpen Redirect · medium · Lovable VDP
    74 votes
15. Open Redirect on ███████Open Redirect · low · Fastly VDP
    74 votes
16. Open RedirectOpen Redirect · low · Affirm
    $25074 votes
17. open redirected by host headerDuplicateOpen Redirect · Localize
    73 votes
18. Open RedirectOpen Redirect · low · Omise
    $10072 votes
19. Identity Login Page Redirect Can Be ManipulatedOpen Redirect · high · Inflection
    72 votes
20. Possible to redirect to a (non-existing) subdomain after logging in via GitHub (leaking the token)Open Redirect · high · Ed
    71 votes
21. Open Redirect Vulnerability in OAuth Flow Leading to Potential Phishing AttackDuplicateOpen Redirect · low · Lichess
    70 votes
22. Host Header InjectionOpen Redirect · New Relic
    70 votes
23. Google API key leaks and security misconfiguration leads Open Redirect VulnerabilityOpen Redirect · medium · Clario
    $30068 votes
24. Stealing Users OAuth Tokens through redirect_uri parameterOpen Redirect · high · GSA Bounty
    $75067 votes
25. Liberapay member team twitter account broken Link Hijacking via Expired Twitter Account LinkOpen Redirect · Liberapay
    65 votes
26. Open redirect using theme installOpen Redirect · Shopify
    61 votes
27. Link poisoning on https://secure.login.gov/ login pageOpen Redirect · low · GSA Bounty
    $15060 votes
28. Open redirect Via X-Forwarded-HostOpen Redirect · low · Omise
    58 votes
29. Open redirection at https://chaturbate.com/auth/login/Open Redirect · low · Chaturbate
    55 votes
30. Link filter protection bypassOpen Redirect · medium · Valve
    55 votes
31. Open Redirect on http://events.hackerone.com/redirect?url=https://naglinagli.github.ioOpen Redirect · HackerOne
    54 votes
32. Open Redirection in Login - Korean StarbucksOpen Redirect · low · Starbucks
    54 votes
33. Open Redirect on https://www.twitterflightschool.com/widgets/experience?destination_url=https://evil.comOpen Redirect · low · X / xAI
    53 votes
34. Open Redirection in index.php pageOpen Redirect · HackerOne
    53 votes
35. Open redirect via redirect_to parameter in tumblr.comOpen Redirect · low · Automattic
    51 votes
36. New link opening method makes hackerone vulnerable to tabnabbingOpen Redirect · low · HackerOne
    51 votes
37. Host Header Injection leads to Open Redirect and Content Spoofing or Text Injection.Open Redirect · medium · Omise
    $30050 votes
38. session takeover via open protocol redirection on streamlabs.comOpen Redirect · medium · Logitech
    $20050 votes
39. [crm.unikrn.com] Open RedirectOpen Redirect · medium · Unikrn
    50 votes
40. Websites opened from reports can change url of report page Open Redirect · medium · HackerOne
    50 votes
41. Open Redirection effects autodiscover.rockstargames.comOpen Redirect · low · Rockstar Games
    49 votes
42. Domain spoofing in redirect page using RTLOOpen Redirect · low · HackerOne
    48 votes
43. Bypassing callback_url validation on DigitsOpen Redirect · X / xAI
    48 votes
44. Open Redirect via Non-Latin Subdomain in vcc-*.8x8.com/AGUI/█.phpOpen Redirect · low · 8x8
    $10046 votes
45. Open redirect vuln on loginOpen Redirect · Vercel
    45 votes
46. Open Redirect on lovable.dev via redirect parameter leads to phishing attacksOpen Redirect · Lovable VDP
    44 votes
47. through %09 Character the attacker is able to steal Github Token [ Account Takeover ]Open Redirect · Vercel
    44 votes
48. Open redirect on https://hq-api.upserve.com/Open Redirect · medium · Upserve
    44 votes
49. page.line.me Open Redirect Leading to OAuth Authorization Code Exposure and Access Token CompromiseOpen Redirect · high · LY Corporation
    $1,00043 votes
50. Open Redirect Vulnerability in Action PackOpen Redirect · medium · Internet Bug Bounty
    $2,40043 votes
51. Open redirect protection (https://www.pixiv.net/jump.php) is broken for novelsOpen Redirect · low · pixiv
    $20042 votes
52. http://www.nextcloud.com/wp-includes/js/swfupload/swfupload.swf allows open redirect / site defacementOpen Redirect · Nextcloud
    42 votes
53. █████████ (Android): Vulnerable to Javascript Injection and Open redirectOpen Redirect · medium · U.S. Dept Of Defense
    41 votes
54. Account takeover using reset password linkOpen Redirect · medium · Mars
    41 votes
55. Browser is not following proper flow for redirection cause open redirect Open Redirect · high · Brave Software
    41 votes
56. Open Redirect on www.redditinc.com via `failed` query paramOpen Redirect · medium · Reddit
    41 votes
57. Open RedirectOpen Redirect · X / xAI
    41 votes
58. [keybase.io] Open RedirectOpen Redirect · Keybase
    $50040 votes
59. Open Redirect filter bypass through '\' character via URL parameterOpen Redirect · medium · Myndr
    39 votes
60. Open redirect vulnerability in index.phpOpen Redirect · HackerOne
    39 votes
61. Open Redirect Vulnerability on TikTok Ads Portal Open Redirect · medium · TikTok
    37 votes
62. Wrong Interpretation of URL encoded characters, showing different punny code leads to redirection on different domainOpen Redirect · low · X / xAI
    $56037 votes
63. Redirection in Repeater & Intruder TabOpen Redirect · low · PortSwigger Web Security
    $15036 votes
64. Bypassing Content-Security-Policy leads to open-redirect and iframe xssOpen Redirect · medium · Stripo Inc
    36 votes
65. Open Redirect through POST Request in OAuthOpen Redirect · low · Moneybird
    34 votes
66. GET based Open redirect on [streamlabs.com/content-hub/streamlabs-obs/search?query=]Open Redirect · low · Logitech
    $10034 votes
67. Open Redirect on Gitllab Oauth leading to Acount TakeoverOpen Redirect · Vercel
    34 votes
68. Open redirect on app.hey.com bypasses HEY desktop's internal-origin allowlist and loads attacker content inside a HEY BrowserWindowOpen Redirect · medium · Basecamp
    33 votes
69. Accepting error message on twitter sends you to attacker siteOpen Redirect · medium · X / xAI
    $56033 votes
70. Open Redirection in [https://www.hackerone.com/index.php]Open Redirect · HackerOne
    33 votes
71. Another window.opener issueOpen Redirect · Open-Xchange
    $90033 votes
72. Open Redirect in Rocket.ChatOpen Redirect · medium · Rocket.Chat
    32 votes
73. wordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-listOpen Redirect · medium · WordPress
    31 votes
74. Open Redirect TO Stealing aadvidOpen Redirect · low · TikTok
    31 votes
75. [http2.cloudflare.com] Open RedirectOpen Redirect · Cloudflare Vulnerability Disclosure
    31 votes
76. Open redirect when logging in with user_oidcOpen Redirect · Nextcloud
    30 votes
77. Tab nabbing via window.openerOpen Redirect · Open-Xchange
    $66630 votes
78. Open Redirect at *.myshopify.com/account/login?checkout_url=Open Redirect · Shopify
    30 votes
79. Attachment references in markdown don't warn before downloading Open Redirect · low · HackerOne
    29 votes
80. Open Redirect at https://oauth.secure.pixiv.netOpen Redirect · low · pixiv
    $20029 votes
81. Open Redirect on https://go.bitwala.com/Open Redirect · medium · Nuri
    29 votes
82. Open Redirect - Polycom Company DirectoryOpen Redirect · low · 8x8
    28 votes
83. [song.link] Open RedirectOpen Redirect · low · Linktree
    28 votes
84. Open redirect bypassOpen Redirect · low · Flickr
    $30028 votes
85. Open Redirect и подмена ссылки в сниппете приложения VKMAOpen Redirect · low · VK.com
    $30028 votes
86. Open Redirect via login avito.ru | Protection bypassOpen Redirect · Avito
    28 votes
87. Open RedirectOpen Redirect · low · Semrush
    28 votes
88. Open Redirection while saving User account Settings Open Redirect · medium · Moneybird
    28 votes
89. Open Redirect (verkkopalvelu.lahitapiola.fi)Open Redirect · LocalTapiola
    $40028 votes
90. Open redirect in bulk editOpen Redirect · Shopify
    28 votes
91. Interstitial redirect bypass / open redirect in https://hackerone.com/zendesk_sessionOpen Redirect · HackerOne
    28 votes
92. Steal any users `access_token` via open redirect in https://streamlabs.com/global/identity?popup=1&r=Open Redirect · medium · Logitech
    27 votes
93. Open Redirect & Information Disclosure [mijn.werkenbijdefensie.nl]Open Redirect · Radancy
    27 votes
94. Open redirect in semrush.comOpen Redirect · low · Semrush
    26 votes
95. Open redirect on chaturbate.com (tipping/purchase_success)Open Redirect · low · Chaturbate
    $25026 votes
96. Event create can create attachments that link to other websites Open Redirect · medium · Nextcloud
    $25025 votes
97. Hyperlink Injection on Email InvitationOpen Redirect · low · Helium
    $5025 votes
98. Open redirect on the https://tt.hboeck.deOpen Redirect · low · Hanno's projects
    25 votes
99. [idp.fr.cloud.gov] Open RedirectOpen Redirect · low · GSA Bounty
    $15025 votes
100. Open Redirect Protection BypassOpen Redirect · X / xAI
     24 votes