AIKIDO-2026-159864

TL;DR

The authorization endpoint sends an unauthenticated prompt=none request to the supplied redirect_uri with a login_required error before the client and redirect_uri are validated against a registered application. Because only the URI scheme is checked, an attacker can craft an authorization link that redirects a victim's browser to an arbitrary attacker-controlled origin, enabling phishing and credential harvesting. The fix validates the request against a registered client first and only redirects to the oauthlib-validated redirect_uri, otherwise falling back to a non-redirecting error response.