Browse / Open Redirect

Open Redirect

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Open Redirect357

Often found together with

• Cross-site Scripting48

Most upvoted Open Redirect reports

AllValidInformativeN/ADuplicate

1. XSS and Open Redirect on MoPub LoginOpen Redirect · X / xAI
   $1,540248 votes
2. [PayPal Android] Remote theft of user session using push_notification_webview deeplinkOpen Redirect · medium · PayPal
   188 votes
3. Open redirect at https://inventory.upserve.com/http://google.com/Open Redirect · medium · Upserve
   $1,200179 votes
4. Open Redirect in Logout & LoginOpen Redirect · medium · Expedia Group Bug Bounty
   171 votes
5. [Venmo Android] Remote theft of user sessionOpen Redirect · medium · PayPal
   151 votes
6. Open redirect due to scanning QR code via brave browserOpen Redirect · high · Brave Software
   148 votes
7. Open URL RedirectionOpen Redirect · medium · Unikrn
   102 votes
8. Open redirect vulnerabilityOpen Redirect · low · Rockstar Games
   $25083 votes
9. OAuth redirect uri validation bypass for :proxima_first_party_sync appsOpen Redirect · high · GitHub
   79 votes
10. Bypass of Open Redirect Fix on lovable.dev via /..// Path Traversal in redirect parameterOpen Redirect · medium · Lovable VDP
    74 votes
11. Open Redirect on ███████Open Redirect · low · Fastly VDP
    74 votes
12. Open RedirectOpen Redirect · low · Affirm
    $25074 votes
13. Open RedirectOpen Redirect · low · Omise
    $10072 votes
14. Identity Login Page Redirect Can Be ManipulatedOpen Redirect · high · Inflection
    72 votes
15. Possible to redirect to a (non-existing) subdomain after logging in via GitHub (leaking the token)Open Redirect · high · Ed
    71 votes
16. Google API key leaks and security misconfiguration leads Open Redirect VulnerabilityOpen Redirect · medium · Clario
    $30068 votes
17. Stealing Users OAuth Tokens through redirect_uri parameterOpen Redirect · high · GSA Bounty
    $75067 votes
18. Liberapay member team twitter account broken Link Hijacking via Expired Twitter Account LinkOpen Redirect · Liberapay
    65 votes
19. Open redirect using theme installOpen Redirect · Shopify
    61 votes
20. Link poisoning on https://secure.login.gov/ login pageOpen Redirect · low · GSA Bounty
    $15060 votes
21. Open redirect Via X-Forwarded-HostOpen Redirect · low · Omise
    58 votes
22. Open redirection at https://chaturbate.com/auth/login/Open Redirect · low · Chaturbate
    55 votes
23. Link filter protection bypassOpen Redirect · medium · Valve
    55 votes
24. Open Redirect on http://events.hackerone.com/redirect?url=https://naglinagli.github.ioOpen Redirect · HackerOne
    54 votes
25. Open Redirection in Login - Korean StarbucksOpen Redirect · low · Starbucks
    54 votes
26. Open Redirect on https://www.twitterflightschool.com/widgets/experience?destination_url=https://evil.comOpen Redirect · low · X / xAI
    53 votes
27. Open Redirection in index.php pageOpen Redirect · HackerOne
    53 votes
28. Open redirect via redirect_to parameter in tumblr.comOpen Redirect · low · Automattic
    51 votes
29. New link opening method makes hackerone vulnerable to tabnabbingOpen Redirect · low · HackerOne
    51 votes
30. Host Header Injection leads to Open Redirect and Content Spoofing or Text Injection.Open Redirect · medium · Omise
    $30050 votes
31. session takeover via open protocol redirection on streamlabs.comOpen Redirect · medium · Logitech
    $20050 votes
32. [crm.unikrn.com] Open RedirectOpen Redirect · medium · Unikrn
    50 votes
33. Websites opened from reports can change url of report page Open Redirect · medium · HackerOne
    50 votes
34. Open Redirection effects autodiscover.rockstargames.comOpen Redirect · low · Rockstar Games
    49 votes
35. Domain spoofing in redirect page using RTLOOpen Redirect · low · HackerOne
    48 votes
36. Bypassing callback_url validation on DigitsOpen Redirect · X / xAI
    48 votes
37. Open Redirect via Non-Latin Subdomain in vcc-*.8x8.com/AGUI/█.phpOpen Redirect · low · 8x8
    $10046 votes
38. Open Redirect on lovable.dev via redirect parameter leads to phishing attacksOpen Redirect · Lovable VDP
    44 votes
39. Open redirect on https://hq-api.upserve.com/Open Redirect · medium · Upserve
    44 votes
40. page.line.me Open Redirect Leading to OAuth Authorization Code Exposure and Access Token CompromiseOpen Redirect · high · LY Corporation
    $1,00043 votes
41. Open Redirect Vulnerability in Action PackOpen Redirect · medium · Internet Bug Bounty
    $2,40043 votes
42. Open redirect protection (https://www.pixiv.net/jump.php) is broken for novelsOpen Redirect · low · pixiv
    $20042 votes
43. http://www.nextcloud.com/wp-includes/js/swfupload/swfupload.swf allows open redirect / site defacementOpen Redirect · Nextcloud
    42 votes
44. █████████ (Android): Vulnerable to Javascript Injection and Open redirectOpen Redirect · medium · U.S. Dept Of Defense
    41 votes
45. Account takeover using reset password linkOpen Redirect · medium · Mars
    41 votes
46. Browser is not following proper flow for redirection cause open redirect Open Redirect · high · Brave Software
    41 votes
47. Open Redirect on www.redditinc.com via `failed` query paramOpen Redirect · medium · Reddit
    41 votes
48. Open RedirectOpen Redirect · X / xAI
    41 votes
49. Open Redirect filter bypass through '\' character via URL parameterOpen Redirect · medium · Myndr
    39 votes
50. Open redirect vulnerability in index.phpOpen Redirect · HackerOne
    39 votes
51. Open Redirect Vulnerability on TikTok Ads Portal Open Redirect · medium · TikTok
    37 votes
52. Wrong Interpretation of URL encoded characters, showing different punny code leads to redirection on different domainOpen Redirect · low · X / xAI
    $56037 votes
53. Redirection in Repeater & Intruder TabOpen Redirect · low · PortSwigger Web Security
    $15036 votes
54. Bypassing Content-Security-Policy leads to open-redirect and iframe xssOpen Redirect · medium · Stripo Inc
    36 votes
55. Open Redirect through POST Request in OAuthOpen Redirect · low · Moneybird
    34 votes
56. GET based Open redirect on [streamlabs.com/content-hub/streamlabs-obs/search?query=]Open Redirect · low · Logitech
    $10034 votes
57. Open redirect on app.hey.com bypasses HEY desktop's internal-origin allowlist and loads attacker content inside a HEY BrowserWindowOpen Redirect · medium · Basecamp
    33 votes
58. Accepting error message on twitter sends you to attacker siteOpen Redirect · medium · X / xAI
    $56033 votes
59. Open Redirection in [https://www.hackerone.com/index.php]Open Redirect · HackerOne
    33 votes
60. Open Redirect in Rocket.ChatOpen Redirect · medium · Rocket.Chat
    32 votes
61. wordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-listOpen Redirect · medium · WordPress
    31 votes
62. Open Redirect TO Stealing aadvidOpen Redirect · low · TikTok
    31 votes
63. Open redirect when logging in with user_oidcOpen Redirect · Nextcloud
    30 votes
64. Open Redirect at *.myshopify.com/account/login?checkout_url=Open Redirect · Shopify
    30 votes
65. Attachment references in markdown don't warn before downloading Open Redirect · low · HackerOne
    29 votes
66. Open Redirect at https://oauth.secure.pixiv.netOpen Redirect · low · pixiv
    $20029 votes
67. Open Redirect on https://go.bitwala.com/Open Redirect · medium · Nuri
    29 votes
68. Open Redirect - Polycom Company DirectoryOpen Redirect · low · 8x8
    28 votes
69. [song.link] Open RedirectOpen Redirect · low · Linktree
    28 votes
70. Open redirect bypassOpen Redirect · low · Flickr
    $30028 votes
71. Open Redirect и подмена ссылки в сниппете приложения VKMAOpen Redirect · low · VK.com
    $30028 votes
72. Open Redirect via login avito.ru | Protection bypassOpen Redirect · Avito
    28 votes
73. Open RedirectOpen Redirect · low · Semrush
    28 votes
74. Open Redirection while saving User account Settings Open Redirect · medium · Moneybird
    28 votes
75. Open redirect in bulk editOpen Redirect · Shopify
    28 votes
76. Interstitial redirect bypass / open redirect in https://hackerone.com/zendesk_sessionOpen Redirect · HackerOne
    28 votes
77. Steal any users `access_token` via open redirect in https://streamlabs.com/global/identity?popup=1&r=Open Redirect · medium · Logitech
    27 votes
78. Open redirect in semrush.comOpen Redirect · low · Semrush
    26 votes
79. Open redirect on chaturbate.com (tipping/purchase_success)Open Redirect · low · Chaturbate
    $25026 votes
80. Event create can create attachments that link to other websites Open Redirect · medium · Nextcloud
    $25025 votes
81. Hyperlink Injection on Email InvitationOpen Redirect · low · Helium
    $5025 votes
82. Open redirect on the https://tt.hboeck.deOpen Redirect · low · Hanno's projects
    25 votes
83. [idp.fr.cloud.gov] Open RedirectOpen Redirect · low · GSA Bounty
    $15025 votes
84. Open Redirect Protection BypassOpen Redirect · X / xAI
    24 votes
85. Tab nabbing in Hackerone inbox.Open Redirect · low · HackerOne
    $50023 votes
86. Open redirect on https://signin.rockstargames.com/connect/authorize/rsgOpen Redirect · low · Rockstar Games
    23 votes
87. Open redirect in https://www.rockstargames.com/GTAOnline/restricted-content/agegate/form may lead to Facebook OAuth token theftOpen Redirect · low · Rockstar Games
    23 votes
88. Open redirect at app.goodhire.com via ReturnUrl parameterOpen Redirect · high · Inflection
    23 votes
89. Open redirect in user_saml via RelayState parameterOpen Redirect · low · Nextcloud
    21 votes
90. Open Redirect - https://████████.jetblue.com/███?url=Open Redirect · low · JetBlue
    21 votes
91. Open redirect found on account.brave.comOpen Redirect · medium · Brave Software
    21 votes
92. Open Redirect on www.redditinc.com via `failed` query param bypass after fixed bug #1257753Open Redirect · medium · Reddit
    21 votes
93. Open RedirectionOpen Redirect · low · JetBlue
    21 votes
94. Instant open redirect on Live preview WEB Ide openingOpen Redirect · low · GitLab
    $1,00020 votes
95. Open Redirect through POST RequestOpen Redirect · medium · Inflection
    20 votes
96. https://xmpp.nextcloud.com///;@www.google.com allows open redirectOpen Redirect · Nextcloud
    20 votes
97. Hyperlink Injection in Friend Invitation EmailsOpen Redirect · Algolia
    $10020 votes
98. https://windsor.shopify.com/ takeoverOpen Redirect · Shopify
    20 votes
99. CVE-2022-45402: Apache Airflow: Open redirect during loginOpen Redirect · medium · Internet Bug Bounty
    19 votes
100. Open Redirect (6.0.0 < rails < 6.0.3.2)Open Redirect · high · Ruby on Rails
     $1,00019 votes