Cyber Resilience

CWE · MITRE source

CWE-601URL Redirection to Untrusted Site ('Open Redirect')

Abstraction: Base · CVEs in our corpus: 1,666

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Last updated: 22 August 2026 14:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 1 mapping(s) from 1 framework(s): CAPEC 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • AT-2 Literacy Training and Awareness
  • SI-10 Information Input Validation
  • PR.PS-06
  • AC-4 Information Flow Enforcement
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V3.7.2

NIST 800-53 r5 controls that address this weakness (2)AI-assisted

Control Title Family Why it addresses this CWE
AT-2Literacy Training and AwarenessATSecurity awareness includes verifying URLs and avoiding untrusted redirects that lead to malicious sites.
SI-10Information Input ValidationSIValidates redirect targets and URLs to ensure they conform to allowed destinations.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2017-1000117 9.18.80.77822017-10-05
CVE-2025-4123 8.47.60.98362025-05-22
CVE-2016-5385 8.28.10.50432016-07-19
CVE-2018-3774 7.910.00.03812018-08-12
CVE-2025-50578 7.89.80.02782025-07-30
CVE-2022-31657 7.69.80.01332022-08-05
CVE-2024-22891 7.69.80.01692024-03-01
CVE-2025-6023 7.67.60.39082025-07-18
CVE-2012-0518 KEV 7.54.70.04692012-10-16
CVE-2021-38000 KEV 7.56.10.04652021-11-23
CVE-2017-11879 7.48.80.09402017-11-15
CVE-2025-55031 7.39.80.00412025-08-19
CVE-2025-43526 7.39.80.00522025-12-17
CVE-2020-36912 7.39.80.00382026-01-06
CVE-2019-25282 7.39.80.00382026-01-08
CVE-2017-8989 7.29.10.01752018-08-06
CVE-2019-10098 7.26.10.73982019-09-25
CVE-2021-22881 7.26.10.87302021-02-11
CVE-2022-40083 7.29.60.02472022-09-28
CVE-2022-45402 7.26.10.81842022-11-15
CVE-2019-6741 7.19.30.03232019-06-03
CVE-2020-8143 7.16.10.70392020-04-03
CVE-2021-22873 7.16.10.69562021-01-26
CVE-2018-11784 7.04.30.94492018-10-04
CVE-2020-1927 7.06.10.56692020-04-02