Скачать или смотреть OWASP A01:2025 | CWE-61 Explained | Open Redirect & Broken Access Control

A01:2025 – CWE-61 Explained | Open Redirect (Release Candidate)

CWE-61 (Open Redirect) is a security weakness associated with
A01:2025 – Broken Access Control in the OWASP Top 10: 2025 Release Candidate.

This weakness occurs when an application allows user-controlled URLs or parameters to determine redirection targets without proper validation, enabling attackers to redirect users to malicious or unauthorized destinations while abusing the application’s trusted context.

📌 What you’ll learn in this video:

🔹 What CWE-61 (Open Redirect) is
🔹 How open redirects break logical access and trust boundaries
🔹 Real-world exploitation scenarios (phishing, token theft, malware delivery)
🔹 Why CWE-61 is mapped to A01:2025 – Broken Access Control
🔹 Impact on users, sessions, and organizational trust
🔹 Secure design and prevention techniques

🧠 Why CWE-61 matters under A01:2025:

Enables phishing using a trusted domain

Abuses authentication and authorization flows

Can lead to session token leakage

Frequently exploited in login, logout, SSO, and password reset flows

Causes serious audit, compliance, and reputational issues

🛡️ Prevention & Mitigation (High Level):

✔ Use allow-lists for redirect destinations
✔ Avoid redirecting directly based on user input
✔ Use internal route identifiers instead of URLs
✔ Validate and normalize redirect targets
✔ Apply security reviews on authentication & SSO flows

🎯 Who should watch this video:

✔ Application & API Developers
✔ SOC Analysts & Security Engineers
✔ VAPT & Penetration Testers
✔ GRC & Compliance Professionals
✔ CISOs & Risk Owners
✔ Cybersecurity learners

If you work with:
✔ OWASP Top 10
✔ Secure authentication flows
✔ VAPT and pentest reports
✔ ISO/IEC 27001
✔ SOC 2
✔ SEBI CSCRF

…this video will help you understand CWE-61 as a trust and access-control failure—not just a “minor redirect issue.”

📌 Watch till the end to see how open redirects silently undermine security controls and user trust.

🔔 LIKE | SUBSCRIBE | PRESS THE BELL ICON
for deep-dive content on OWASP, CWEs, AppSec, SOC, and GRC.

🤖 AI Transparency Notice

This video was created with assistance from AI tools such as ChatGPT, NotebookLM, Gemini, and HeyGen.
All explanations, diagrams, and examples are human-reviewed and curated strictly for educational purposes.
All standards and frameworks referenced belong to their respective authorities.

#A012025
#CWE61
#BrokenAccessControl
#OWASPTop10
#OpenRedirect
#AppSec
#Cybersecurity
#VulnerabilityManagement
#SecureCoding
#SOC
#GRC
#PenetrationTesting
#VAPT
#ISO27001