CVE-2026-79662

Name of the Vulnerable Software and Affected Versions Ech0 versions prior to 4.7.3

Description An OAuth redirect URI validation issue exists in the parseAndValidateClientRedirect() function (internal/service/auth/auth.go). The system only compares the scheme and host of the client-supplied redirect uri against the admin-configured allowlist, ignoring the path, query, and fragment components. Consequently, the redirect uri is embedded into the signed state JWT during login without full validation. An attacker can craft a redirect uri with a host that matches an allowed origin but contains an attacker-influenced path. Following the OAuth exchange, the victim is redirected to this path with a one-time exchange code in the query string. If this code leaks through Referer headers, analytics, or an open redirect on that host, the attacker can use the public 'POST /api/auth/exchange' endpoint to obtain the victim's access and refresh tokens.

Recommendations Update to version 4.7.3.