AIKIDO-2026-10150

TL;DR

Affected versions of this package were vulnerable to improper URL and origin validation, enabling a generic OAuth redirection abuse issue. An attacker could manipulate unvalidated or weakly validated redirect/origin values to force the application to redirect sensitive OAuth responses (such as access tokens) to attacker-controlled endpoints, including look-alike or crafted URLs that bypass origin checks, resulting in token leakage and unauthorized account access.