A site uses the URL /redirect?url=http://partner.com to forward users. An attacker crafts /redirect?url=http://evil.com and sends it in a phishing email. What vulnerability is this?

Why D is correct

Open Redirect occurs when the redirect destination is not validated. Attackers leverage trusted domains to make malicious links appear legitimate in phishing emails. The fix is to allowlist redirect destinations or use only relative paths.