Open Redirect on https://www.twitterflightschool.com/widgets/experience?destination_url=https://evil.com

Summary

This report details an open redirect issue that enabled crafting potentially malicious URLs which could be used to redirect users to a site specified in a URL parameter of the URL creator's choosing. This may allow an attacker to exploit a user's trust by leveraging open redirect on the affected subdomains (flightschool.twitter.com and takeflight.twitter.com) to launch phishing scams by masquerading as the legitimate websites.

This vulnerability is part of a study I have been conducting about "Vulnerability inheritance - Attacking companies and scoring bounties through 3rd party integrations".

twitterflightschool.com was pointing towards a 3rd party vendor as a CNAME, I managed to find Stored Open Redirect on an endpoint which belongs to the vendor that allowed me to achieve Stored Open Redirects on 2 domains under *.twitter.com which are

flightschool.twitter.com, 

and

takeflight.twitter.com

Although twitter policy states that those should be rewardable, it wasn't in this case.