CWE-601URL Redirection to Untrusted Site ('Open Redirect')

Abstraction: Base · CVEs in our corpus: 1,780

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Last updated: 16 October 2026 12:22 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

AT-2 Literacy Training and Awareness
SI-10 Information Input Validation
PR.PS-06
SI-10 Information Input Validation

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V3.7.2

NIST 800-53 r5 controls PROPOSED for this weakness (2)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
`SI-10`	Information Input Validation	SI	graded mostly Validates redirect targets and URLs to ensure they conform to allowed destinations.
`AT-2`	Literacy Training and Awareness	AT	Security awareness includes verifying URLs and avoiding untrusted redirects that lead to malicious sites.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2017-1000117`	9.1	8.8	0.7782	2017-10-05
`CVE-2025-4123`	8.4	7.6	0.9701	2025-05-22
`CVE-2016-5385`	8.2	8.1	0.5043	2016-07-19
`CVE-2018-3774`	7.9	10.0	0.0381	2018-08-12
`CVE-2025-6023`	7.9	7.6	0.5259	2025-07-18
`CVE-2025-50578`	7.8	9.8	0.0280	2025-07-30
`CVE-2022-31657`	7.6	9.8	0.0136	2022-08-05
`CVE-2024-22891`	7.6	9.8	0.0169	2024-03-01
`CVE-2012-0518` KEV	7.5	4.7	0.0469	2012-10-16
`CVE-2021-38000` KEV	7.5	6.1	0.0495	2021-11-23
`CVE-2017-11879`	7.4	8.8	0.0940	2017-11-15
`CVE-2025-55031`	7.3	9.8	0.0041	2025-08-19
`CVE-2025-43526`	7.3	9.8	0.0053	2025-12-17
`CVE-2020-36912`	7.3	9.8	0.0043	2026-01-06
`CVE-2019-25282`	7.3	9.8	0.0043	2026-01-08
`CVE-2017-8989`	7.2	9.1	0.0175	2018-08-06
`CVE-2019-10098`	7.2	6.1	0.7398	2019-09-25
`CVE-2021-22881`	7.2	6.1	0.8730	2021-02-11
`CVE-2022-40083`	7.2	9.6	0.0324	2022-09-28
`CVE-2022-45402`	7.2	6.1	0.8184	2022-11-15
`CVE-2026-101090`	7.2	9.8	0.0036	2026-09-27
`CVE-2019-6741`	7.1	9.3	0.0323	2019-06-03
`CVE-2020-8143`	7.1	6.1	0.7039	2020-04-03
`CVE-2021-22873`	7.1	6.1	0.6956	2021-01-26
`CVE-2026-54618`	7.1	9.4	0.0051	2026-09-17