Open redirect

When it applies

The app redirects to a location derived from user input without validating it stays on-site. Low severity alone — but a powerful chain link.

Why it works

The redirect target is attacker-controlled and trusted. On its own it's phishing; chained, it turns other flows malicious (OAuth codes/tokens sent to your host, SSRF allowlist bypass via a redirect to an internal URL).