Cloudanix VulnDB

GHSA-p64j-f4x9-wq66

High · 8.0

Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft

CVSS

8.0

EPSS

—

Published

May 7, 2026

CISA due date

—

The record

`parseAndValidateClientRedirect` at `internal/service/auth/auth.go:448` validates OAuth client-redirect URIs by comparing only scheme and host against the admin-configured allowlist. Path, query, and fragment are ignored. The initiator at `/oauth/:provider/login` embeds the caller-supplied `redirect_uri` verbatim into the signed state JWT without any validation at login time. Alice submits a crafted `redirect_uri` whose host matches an allowed origin but whose path points to any page on that host. After the provider exchange, Ech0 redirects the victim to the attacker-chosen path with the one-time exchange code in the query string. If the chosen path leaks the URL via Referer, analytics, or an open redirect, the attacker trades the code at `POST /api/auth/exchange` for the victim's access and refresh tokens. RFC 6749 §3.1.2 requires exact redirect URI matching.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities