OWASP Top 10 - A10 Unvalidated redirects and forwards
Channel: Luke Briner
Date: 02/07/2016

This is simply redirecting the user on the server-side with unvalidated data that has originated outside of your control such as a querystring or previously saved data. An attacker can abuse this to forward a victim via the vulnerable web application to an attackers site.