[GlitchMr]

I once reported an open redirect attack to GitHub, and they were like, nah, WONTFIX. I believe the issue still exists.

That said, how useful is an open redirect attack really?

[Kalium]

Depends on where in the system it is. If it's part of a flow involving sensitive data, an open redirect can be used to harvest that data from users. This might be anything from login credentials to bank account info, depending on what flow is involved.