# Unvalidated redirect leaking auth tokens

Auth redirect targets that receive codes, tokens or assertions without exact match to a verified registered value

_Area: Web authentication and account takeover. Seen in 6 disclosed reports; one confirmed bounty: $1,000; latest 2026-10-30. Updated 2026-10-31._

## How it works
An auth endpoint takes a redirect target from the request (query param, hash, SAML field, or client registration) and delivers a credential to it — OAuth code/token, reset token, or SAML assertion. The broken assumption is that the target belongs to the relying party. When it doesn't, the credential reaches the attacker's URL, or leaks via Referer, with no further step [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-h29v-hj44-q8cv.md)[E5](https://bugbountylibrary.com/r/h1%3A3955956.md)[E6](https://bugbountylibrary.com/r/h1%3A1327742.md). A related shape: the token is placed in a URL that later leaks through a chained open redirect [E1](https://bugbountylibrary.com/r/h1%3A835437.md), or concatenated onto an attacker-supplied link and emailed [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v.md).

## Where it shows up
- Handlers reading `redirect_uri`, `returnRoute`, `baseUrl`, `targetOrigin`, `r`, or `resetPasswordUrl` and building a Location or email link from them [E1](https://bugbountylibrary.com/r/h1%3A835437.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-h29v-hj44-q8cv.md)[E6](https://bugbountylibrary.com/r/h1%3A1327742.md).
- Validation that only checks an origin regex, or runs at authorize time but not registration time [E1](https://bugbountylibrary.com/r/h1%3A835437.md)[E5](https://bugbountylibrary.com/r/h1%3A3955956.md).
- SAML IdP using `AssertionConsumerServiceURL` from the AuthnRequest as Destination/Recipient [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9w9-87c8-m235.md).
- Error branches (invalid scope, bad client) that still redirect [E7].
- Allowlists containing third-party domains not owned by the service [E6](https://bugbountylibrary.com/r/h1%3A1327742.md).
- Implicit grant still enabled, delivering tokens straight to the redirect [E5](https://bugbountylibrary.com/r/h1%3A3955956.md).

## How to review
The invariant: every credential-bearing redirect target must exactly match a value registered and ownership-verified for that client, checked on the same request that emits the credential. Enumerate every handler consuming a redirect target and confirm each calls the same validator; confirm registration proves ownership of the URI (distinct from authorize-time matching — exact match can pass on a never-verified URI [E5](https://bugbountylibrary.com/r/h1%3A3955956.md)); confirm error paths reject rather than redirect; confirm SAML Destination/Recipient equals the stored per-client ACS [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9w9-87c8-m235.md); confirm tokens are not placed in URLs that can leak via Referer [E1](https://bugbountylibrary.com/r/h1%3A835437.md).

## Variants seen
- Chained open redirects plus Referer leakage of a token carried in the URL [E1](https://bugbountylibrary.com/r/h1%3A835437.md).
- Server-generated reset token concatenated onto attacker-supplied URL and emailed [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v.md).
- Omitted sibling endpoint after a partial class fix [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-h29v-hj44-q8cv.md).
- SAML ACS taken from request, signature validation default-off [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9w9-87c8-m235.md).
- Registration-time trust gap with implicit grant [E5](https://bugbountylibrary.com/r/h1%3A3955956.md).
- Stale third-party allowlist entries [E6](https://bugbountylibrary.com/r/h1%3A1327742.md).
- Open redirect on an error path, no credential delivery shown [E7].

## Why fixes fail
A partial patch added origin validation to several handlers but left `/authorize` unpatched, so the class persisted [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-h29v-hj44-q8cv.md). Conditional/default-off signature checks leave the SAML path exposed [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9w9-87c8-m235.md).

## Impact and severity
Full account takeover: admin hijack [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v.md), token theft enabling API read/write/delete [E5](https://bugbountylibrary.com/r/h1%3A3955956.md)[E6](https://bugbountylibrary.com/r/h1%3A1327742.md), identity assertion replay [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-p9w9-87c8-m235.md). Severity rises with implicit grant, token login that disables 2FA [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v.md), and long-lived refresh tokens [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-h29v-hj44-q8cv.md)[E5](https://bugbountylibrary.com/r/h1%3A3955956.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A835437.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-h29v-hj44-q8cv.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-p9w9-87c8-m235.md
- E5: https://bugbountylibrary.com/r/h1%3A3955956.md
- E6: https://bugbountylibrary.com/r/h1%3A1327742.md