Tornado's RedirectHandler prior to version 6.6 allows crafted requests to cause open redirects via protocol-relative URLs or substitutions that alter the scheme or host in the redirect URL. This occurs when URL templates use regex capture groups that influence the scheme or host, enabling attackers to redirect users to arbitrary external sites. The vulnerability is fixed in Tornado 6.6, which rejects such substitutions with a 400 error.