Many apps redirect people after an action, most often after login, using a parameter such as next, redirect or returnTo. If the server or the frontend forwards the visitor to any value it finds there, an attacker can craft a link that starts on your real domain and ends on a site they control.
The victim sees your domain in the link, clicks with confidence, and lands on a copy of your login page that collects their password. The same flaw can also weaken other protections. If a login flow built on OAuth accepts a loosely checked redirect address, a token or code meant for your app can be sent to the attacker's site instead.
AI tools generate this pattern often because 'send the user back where they came from' is a common request. Prefer redirecting to a fixed page. If the destination must be dynamic, accept only relative paths that start with a single slash, or compare the value against a short allow list of full addresses, and reject everything else.
https://app.example.com/login?next=https://evil.example/login