Exploitation of Open Redirects / Unvalidated Redirects

Use an application's unvalidated redirect in a targeted email link so the recipient-facing URL begins at the legitimate application before redirecting to an approved assessment landing page. An open redirect can make the link appear more trustworthy, but it does not itself send mail, cause a click, capture credentials, or establish access.