OAuth Redirect URI Validation Vulnerability in Ech0 by Lin-Snow

CVE-2026-79662

What is CVE-2026-79662?

The Ech0 product prior to version 4.7.3 is susceptible to a vulnerability related to OAuth redirect URI validation. Specifically, it inadequately validates the redirect_uri by only comparing the scheme and host against a predefined allowlist. This oversight permits attackers to manipulate the path, query, or fragment components of the redirect_uri, enabling unauthorized redirection post-OAuth exchange. Consequently, if an attacker manages to craft an appropriate redirect_uri that matches an allowed origin, they can retrieve the one-time exchange code embedded within the query string. If this code is exposed, it can be exploited via the public exchange endpoint, resulting in potential access to users' tokens.

References