apis.google.com – Insecure redirect via __lu parameter (exploited in the wild)  – Full Disclosure

Posted by Patrick via Fulldisclosure on Oct 18

—————————————————————————-
Summary
—————————————————————————-
A CWE-601 (Open Redirect) vulnerability has been identified in the additnow
functionality of apis.google.com. The vulnerability has been actively exploited
in targeted phishing attacks since at least September 15, 2025….
 – Read More  – Full Disclosure