A redirect target comes straight from user input (a query-string value or a returnUrl-style parameter) and is passed to Redirect(...) without a local-URL check.

using Microsoft.AspNetCore.Mvc;

public class AccountController : Controller
{
    public IActionResult LoginCallback(string returnUrl)
    {
        // ruleid: auth.csharp.flow.open-redirect
        return Redirect(returnUrl);
    }

    public IActionResult Back()
    {
        // ruleid: auth.csharp.flow.open-redirect
        return Redirect(Request.Query["next"]);
    }
}

using Microsoft.AspNetCore.Mvc;

public class AccountController : Controller
{
    public IActionResult LoginCallback(string returnUrl)
    {
        // ok: local-URL check before redirecting
        if (Url.IsLocalUrl(returnUrl))
        {
            return Redirect(returnUrl);
        }
        return RedirectToAction("Index", "Home");
    }

    // ok: LocalRedirect throws on a non-local URL
    public IActionResult Safe(string returnUrl)
    {
        return LocalRedirect(returnUrl);
    }
}