Royal Mail jeopardizes users with open redirect flaw

The British postal service and courier company has left an open redirect vulnerability on one of its sites, exposing its customers to phishing attacks and malware infections.

The centuries-old Royal Mail is the largest courier company in the UK, boasting twice the market share of Amazon.

At the beginning of the year, the company made headlines after it refused to pay LockBit’s $80 million ransom, calling it “absurd.” The ransomware attack by a Russia-linked syndicate crippled Royal Mail, and it temporarily couldn’t dispatch items overseas.

The company might have upped its security game since the incident, however, recent Cybernews research shows that there’s room for improvement.

Our research team found that a site belonging to Royal Mail had an open redirect vulnerability.

An open redirect vulnerability is a security flaw that arises when a web application utilizes user-supplied input, such as a URL or parameter, to direct the user to a different page without appropriately verifying or cleansing the input.

Redirection scheme

“The vulnerability can be exploited by attackers to trick users into visiting malicious websites or phishing pages by disguising the malicious URL as a legitimate one,” Cybernews researchers explained.

We’ve repeatedly informed the company about the flaw, and the site in question has been down for months now, indicating that Royal Mail is working to mitigate the issue or has already done so. The company has yet to respond to our requests for comments.


  • Users can be lured into fake websites designed to steal credentials and credit card numbers, among other things.
  • Open redirect vulnerabilities can be leveraged to download malicious software onto the victims’ devices.
  • Users might end up on pages filled with spam and other low-quality content.


  • Companies facing similar issues should validate all user input.
  • Websites can use URL encoding to prevent URL tampering.
  • Website owners can create a whitelist of trusted URLs and only allow redirects to those URLs.

More from Cybernews:

​​Book review – Going Infinite: The Rise and Fall of a New Tycoon

Inside the 4-Foot reality: San Francisco's $900 “pod life” experiment

IoT zombie botnet suddenly goes dark: who killed it remains a mystery

The hacker who breached NASA to prove that UFOs exist

Apple called Android a “massive tracking device,” internal document reveals

Subscribe to our newsletter

Leave a Reply

Your email address will not be published. Required fields are markedmarked