CVE-2025-43916

Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirecturi containing userinfo in the authority component, which is not consistent with RFC 6819 section 5.2.3.5. An authorization code may be sent to an attacker-controlled destination. This might have...

PT-2025-17434 · Sonos · Sonos

Name of the Vulnerable Software and Affected Versions: Sonos versions through 2025-04-21 Description: The issue concerns the /login/v3/oauth endpoint, which accepts a redirect uri containing userinfo in the authority component. This is inconsistent with RFC 6819 section 5.2.3.5, potentially...