The OWASP state that open redirect is a vulnerability:
An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.
However, it's trivial for an attacker to create a phishing URL and get it shortened, thus "get[ting] users to visit malicious sites without realizing it".
Does this mean that all URL shorteners (e.g bit.ly, goo.gl, etc) are by definition vulnerable?
How can a URL shortener be fixed/modified such that it does not violate OWASP?