A transit portal redirects users to any URL supplied in a next= parameter without allowlisting. Why is this still a meaningful finding for civic staff phishing risk?
Select an answer to reveal the explanation.
Short Explanation
A trusted city domain that happily ships you to evil.example looks like a hall pass from management. Open redirects help phishing and some token-stealing patterns because staff trust the first hop. They are not "just SEO," and they are not the same thing as SSRF to metadata.
Full Explanation
Unvalidated redirects allow attackers to craft links that begin on a trusted municipal hostname and land on malicious sites, increasing phishing success and enabling certain OAuth or token abuse patterns. Testers should report open redirects with realistic civic phishing impact rather than dismissing them as cosmetic. The issue is distinct from SSRF and is not blocked by browsers in all cases. Recommend allowlists or fixed post-login destinations.