If every vulnerability is "serious", then none of them are, and the word loses its meaning and people stop responding to it.

If not every vulnerability is "serious" but open redirection is, what do you call something like command injection or SQL injection? "Double-plus serious"?

I understand that developers need to take security seriously, but that effort is undermined by being hyperbolic about vulnerability severity. No one is trying to say open redirection isn't a vulnerability, it's just not all that...well, serious. Fix it, but it's not a hair on fire problem.

Your statement implies there's an unlimited number of these but there aren't. SQL injection is worse than open direction, but storing your passwords and CC data in plaintext and leaving your root account SSH-able on port 22 with no password is worse than SQL injection. Just because there's something worse than X doesn't mean X is not bad.

The important thing here is open redirection is a stupid, optional behavior and there's no good reason for it. It shouldn't be there. Allowing it is just as stupid as allowing XSS. It's just lazy and sloppy and frankly inexcusable for a company like Google, which should be held to a much higher standard than a mom and pop web store that sells cat figurines.

So your stance is the first option, that basically any security vulnerability is serious. The grand majority of vulnerabilities are much simpler to fix than they are to find; once you find them, fixing them is generally straightforward. Given that we are using fundamentally different and incompatible definitions of the word "serious", we are obviously going to continue to disagree on this point. Perhaps it would help if I reframe this for you - there are vulnerabilities which warrant an on-call engineer being woken up at 4 am, and there are those which do not. Further, there are vulnerabilities which need to be fixed this week and those which can wait until the next feature release. If you don't like my use of the word "serious", hopefully you'll find that more agreeable. I don't think we are arguing over the same point anymore.

You continue on to attack Google for having this vulnerability, but I don't think you have spent much time doing vulnerability research if you react that way about a company of Google's size. The sheer codebase alone basically guarantees every type of vulnerability will be found. Furthermore, being antagonistic about it in the way that you are is not conducive to recognition or remediation. Attempting to shame companies or engineering teams is counterproductive to developer awareness and education. At the end of the day, this is just a specialization and your job is not to be mean to them for making mistakes, it's to try to improve their understanding and help them resolve the issue while avoiding it in the future.

I'll sum it up as: "Google is not outside of the mainstream in their assessment."

I get 6.5 .. that seems kind of serious.

I strongly recommend people avoid CVSS. Pentesters with clients that require CVSS in reports spend an extra couple minutes on every vuln in that silly calculator trying to figure out how to make XSS come out to sev:med and logout CSRF to sev:info.

It's not great, but do you have something better?

If you browse the vulnerabilities listed by CVSS for random Linux utilities, for example, you'll find the same vulnerability listed several times with different ratings despite them apparently having the same exploitation requirements and final impact ("authentication not required, remote attacker, potential user data compromise", etc).

Then it will generally go on to give a vague explanation that is absent any real exploitation details and simply link to five different websites that all copy-pasted the same SecLists disclosure verbatim.

Basically, it's crap, and it exists because the information security industry is bifurcated into two different industries - the risk folks and scanner Rockies who don't have any real technical competency but who love to have things like the CISSP and those who actually know what they're doing in the trenches of technical penetration testing and security audits.

The industry unfortunately attracts two distinct crowds - people who can and do develop actual software, but who specialize in security, and people who can talk the talk and have a vested interest in the pomp that comes along with crappy guidelines.

If you asked a real vulnerability researcher like Tavis Ormandy to CVSS score any of his findings, he'd probably laugh. His disclosures are usually verbose precisely because this is an industry that should be nuanced.

Just because we have nothing better does not mean we should heed an abysmal system.

Part of my comment was directed at the fact that the mainstream standards of security for web developers (speaking as one myself) are too low.

Also: WordPress is far outside the mainstream of security practice; they are, and have been for coming up on a full decade, a running joke in the field.

Nobody says that about Google.

If you're saying that you meant the mainstream of security professionals specifically, I'd be interested in what a survey of security professionals had to say about open redirect. For me it's clearly a potential attack vector, and Google's specific implementation is obviously sloppy and lazy. I can't see any security professional worth their salt giving it a pass.

As far as Google not being a running joke, that's true and it's all the more reason it's surprising they are so dismissive of concerns about their way too broad whitelist.

(XSS is the canonical sev:medium, for what it's worth).