4 matches found
CVE-2026-79662
Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect internal/service/auth/auth.go that compares only the scheme and host of the client-supplied redirecturi against the admin-configured allowlist, ignoring path, query, and fragment component...
CVE-2026-79662
Ech0 through 4.5.6 contains an OAuth redirect URI validation bypass in parseAndValidateClientRedirect (internal/service/auth/auth.go). The function compares only the scheme and host of the client-supplied redirect_uri against the admin-configured allowlist, ignoring path, query, and fragment comp...
EUVD-2026-65452
Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect internal/service/auth/auth.go that compares only the scheme and host of the client-supplied redirecturi against the admin-configured allowlist, ignoring path, query, and fragment component...
CVE-2026-79662 Ech0 before 4.7.3 OAuth Redirect URI Validation Bypass
Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect internal/service/auth/auth.go that compares only the scheme and host of the client-supplied redirecturi against the admin-configured allowlist, ignoring path, query, and fragment component...