"CWE-601: URL Redirection to Untrusted Site ('Open Redirect')" falls under "A01:2025 Broken Access Control"

[RobinvandenHurk]

Hi!

Right now (and in 2021 too) CWE-601 - URL Redirection to Untrusted Site ('Open Redirect') is mapped to A01:2025 Broken Access Control. It seems to me that this is an error. The OWASP website states the following:

Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification or destruction of all data, or performing a business function outside the user's limits.

An open redirect vulnerability does not allow users to act outside of their intended permissions. Generally, the user is routed to a completely different site and the first site's permissions do not apply.

I think that CWE-601 is better categorized under A05:2025 Injection.

Thanks!

[prasunsrivastav123-lang]

hey @RobinvandenHurk
I agree with your reasoning — CWE-601 (Open Redirect) doesn’t really fit A01:2025 Broken Access Control, since it doesn’t allow users to perform actions beyond their intended permissions.
Mapping it to A05:2025 Injection (or at least reconsidering the current classification) makes more sense based on the OWASP definitions.

If needed, I’d be happy to help update or clarify the mapping.