What is open redirect?
An open redirect attack is a type of attack that exploits a security vulnerability to redirect users to malicious websites.
Azərbaycanca: Açıq yönləndirmə (open redirect) hücumu, təhlükəsizlik zəifliyindən istifadə edərək istifadəçiləri zərərli veb-saytlara yönləndirməyə imkan verən bir hücum növüdür.
How it works
An open redirect attack exploits a vulnerability in a web application, allowing it to redirect users to untrusted URLs. This typically occurs due to the lack of proper validation or sanitization of user-supplied data.
Defense checklist5
- 01
Always validate and sanitize user-supplied URLs and other data.
- 02
Use the latest and most secure versions of libraries and frameworks used in the application.
- 03
Apply security updates and patches in a timely manner.
- 04
Implement security checks at entry points and redirects.
- 05
Educate users on security best practices and the importance of being cautious with suspicious activities.
Real-world evidence
Open redirect vulnerabilities have been identified in various web applications, including Unblu Spark (CVE-2026-8152), Shopware (CVE-2026-48012), Next.js (CVE-2026-64645), Dify AI Workflow (CVE-2026-18266), IBM Planning Analytics Local (CVE-2026-10545), Grav form plugin (CVE-2026-69087), kalcaddle kodbox (CVE-2026-18721), HUMANIST Digital Human Resources (CVE-2026-14219), Tobit Laboratories AG TeamDavid's Webbox (CVE-2026-54214), Home Assistant (CVE-2026-59717), Saurus CMS Community Edition (CVE-2026-73671), and Joomla Extension - yootheme.com (CVE-2026-75114).
Sources
- CVE-2026-8152: Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cnvd
- CVE-2026-48012: Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redinvd
- CVE-2026-64645: Next.js is a React framework for building full-stack web applications. In versions 12.0.0nvd
- CVE-2026-18266: Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability. This vulnerability allowsnvd
- CVE-2026-10545: IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that anvd
- CVE-2026-69087: The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open redirect vunvd
- CVE-2026-18721: A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects somenvd
- CVE-2026-14219: URL redirection to untrusted site ('open redirect') vulnerability in Bilin Software and Innvd
- CVE-2026-54214: Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injectionvd
- CVE-2026-59717: Home Assistant is open source home automation software focused on local control and privacnvd
- CVE-2026-73671: Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in thnvd
- CVE-2026-75114: Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate(nvd
Other attack types
See also6
This guide is AI-written from the real incident sources skopnix collected — the examples above are drawn from those cited items, nothing is invented.