Is there a vulnerability in subdomain redirection, similar to Open Redirect

Question

I found a website that has the parameter post_login_redirect= I can change to any existing and non-exisiting subdomains, but there is no possibility to redirect to another domain. The redirect occurs after the user logs in.

For example:

we have sub.domain.com and we can change to anything if we respect the domain.com. so we can redirect to a.b.c.b.domain.com even if that subdomain doesn't exist, it will redirect anyway. But we can't redirect to a.hello.com

This is not an open redirect issue, because we can only redirect to subdomains that we don't own.

Is there any possibility to chain this or make this a real vulnerability?

Answer 1

Who would be affected if this was a valid Open redirect attack, if it only redirects to its subdomains. If we can redirect it to a subdomain that then navigates the user to an untrusted domain, we can speak about a valid Open Redirection attack.

Low: post_login_redirect=sub.domain.com
High: post_login_redirect=sub.domain.com/?a=http://www.untrust.ed