#vulns.co
/
mcp by GKData.io

← Back to Gadgets

OAuth redirect_uri mismatch

redirect_uri allowlists that use startsWith, allow subdomains, allow http, honour open redirects on the allowed origin, or accept the token in the query on a public client.

Tags: oauth, ato, oidc

Typical severity: P1-P3

What it becomes

A loose redirect_uri is an ATO gadget. This is one of the highest-converting chains on SSO-heavy programs.

Where to look

  • authorize endpoint
  • mobile custom schemes
  • localhost on production clients
  • multiple registered URIs

Chains

  • ATO — Victim authorises; code or token is delivered to an origin you control; exchange it.
  • Account linking — Pre-account takeover: register with victim email, then link via OAuth without verifying.

Notes

  • Also test state CSRF, PKCE downgrade, and mixing response_type=token on a code client.
  • Open redirect on an allowed redirect_uri origin is enough. You do not need the IdP to allow evil.com directly.

← Back to Gadgets