OAuth redirect_uri Misconfiguration: Stealing Codes the Hunter Way

OAuth redirect_uri Misconfiguration: Stealing Codes the Hunter Way

OAuth’s redirect_uri is supposed to be an exact allowlist match. When providers accept loose prefixes, wildcards, or attacker-controlled paths on a trusted host, authorization codes and tokens fall out of the redirect.

This class still converts into account takeover when the client is a first-party web app with a code flow and weak PKCE (or none).

How I map the flow

1. Start login with the real client_id.
2. Intercept the authorize request; note redirect_uri, response_type, state, PKCE fields.
3. Mutate redirect_uri against the allowlist behavior.
4. Complete only against accounts you own; never phish real users for demos.

Misconfigurations that leak

• Prefix match: https://app.example.com also allows https://app.example.com.evil.tld or https://app.example.com%2f%2fevil depending on parsers — test carefully.
• Path ignore: registered https://app.example.com/cb accepts /cb/../open-redirect on the same host.
• Open redirect on allowed origin: bounce code to external via ?next= / ?url= on a path that is allowlisted.
• Localhost / custom scheme looseness on mobile clients — sometimes over-accepted on web client_ids.
• redirect_uri not tied to client_id — rare, devastating.

Success means the IdP redirects to a location you control with code or token in query/fragment.

Chaining without fiction

You need: (1) redirect_uri flaw, (2) a way to make the victim start OAuth (often just a link), (3) ability to exchange the code if the client secret is public (SPA/mobile) or if token is implicit/fragment. Be honest about PKCE and client type when scoring impact.

Safer proof recipe

Use two browsers. Victim browser = your User A session. Attacker = listener on the malicious redirect. Capture the code, exchange only if in scope and using your client, show session as A on attacker browser. Then revoke.

What defenders should do

Exact string match against pre-registered URIs. No string prefix games. Ban open redirects on OAuth callback hosts. Enforce PKCE for public clients. Rotate codes that hit odd redirect patterns.

OAuth bugs are redirect bugs with tokens attached. Treat redirect_uri like a security boundary — because it is one.