OAuth Server Open Redirect Vulnerability

Executive Summary

CVE-2026-19078 is an open redirect vulnerability in the oauth-server component. It occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that redirects an authenticated user to an attacker-controlled website when they approve or deny a request. This could enable phishing attacks but does not expose OAuth tokens or session credentials.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the oauth-server component for improper validation of the 'then' parameter in the grant approval handler. Check web server logs for unusual redirect patterns or URLs containing the 'then' parameter with external domains. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to trick users into visiting malicious websites through phishing attacks. While it does not directly expose credentials, it may lead to the theft of sensitive information if users are deceived into entering details on fake sites. The impact is limited to phishing attempts and does not involve direct credential exposure.

Useful 0 Not Useful 0

Mitigation Strategies

No available mitigation is provided in the context. The risk is limited as it only facilitates phishing attempts without direct credential exposure. Ensure user awareness of phishing risks and monitor for suspicious redirect activities.

Useful 0 Not Useful 0