OAuth redirect_uri Abuse & Token Theft

In the OAuth authorization-code flow, the redirect_uri tells the authorization server where to send the code. If that value is validated loosely, an attacker can redirect the code to a host they control.

How it works

The registered redirect is, say, https://client.app/callback. Common weak checks and their bypasses:

• Prefix match (startsWith): https://client.app.evil.com/cb passes.
• Substring match (includes): https://evil.com/?x=client.app passes.
• Subdomain/path wildcards: open redirects on the client domain bounce the code onward.

Once the code lands on the attacker's URI, they exchange it at the token endpoint for an access token and impersonate the victim.

How to test

Send authorize requests with mutated redirect_uri values — added subdomains, suffixes, @-tricks (https://client.app@evil.com), path traversal, and encoded characters. If the server issues a code to a non-canonical host, it is vulnerable.

Impact

Account takeover: the stolen code/token grants the attacker the victim's authenticated session at the client.

Defenses

• Exact-match redirect_uri against a pre-registered allow-list — no prefix/substring logic.
• Bind the code to the exact redirect_uri at both authorize and token steps.
• Require PKCE; avoid wildcards and open redirects on registered hosts.