OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses

A security flaw in ORY Fosite's OAuth2 framework allows attackers on the same machine to bypass redirect URL validation by manipulating query parameters or changing the hostname when redirecting to localhost. This could let them intercept authentication tokens meant for legitimate applications.

CVE-2020-15233 involves improper validation of OAuth2 redirect URIs in ORY Fosite v0.30.2–v0.34.0, where case-insensitivity and query parameter handling enable attackers with local access to override registered redirect URLs for loopback addresses. An attacker can craft malicious redirect requests with custom query parameters or modified hostnames to intercept authorization codes or tokens, bypassing URL allowlist checks.