Why it matters
A link on your trusted domain that forwards to any address is a gift to phishers: the link looks like you, but lands on them. This is a hint, so check whether the redirect is validated.
How to check it yourself
Look for links on your site with parameters named redirect, next, url or return that contain a full outside address. Try changing the address to another site: if you get forwarded there, it's open.
What the fix involves
Only allow relative paths or a fixed list of your own domains in redirect parameters, and fall back to the homepage for anything else.
Reference: cheatsheetseries.owasp.org
How vibeliq checks it
We load your page the way a visitor's browser would, read what your server sends back, and look at a short list of well-known addresses on your site. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.