AIKIDO-2026-10825

TL;DR

Redirect URI allowlisting matched paths with fnmatch semantics where wildcards can span slash boundaries. An attacker could register a redirect URI whose path contains dot-segments such that it matches an operator prefix during validation yet normalizes to a different path when the browser resolves a redirect target. The validator now rejects any path containing . or .. segments in both raw and percent-decoded forms before pattern matching, closing prefix bypasses that relied on RFC 3986 dot-segment removal.