CyberRota Analysis
AI-GeneratedThe vulnerability affects Exchange versions Ech0 through 4.5.6, where improper validation of OAuth redirect URIs allows an attacker to exploit the system by crafting a malicious redirect URI that matches an allowed origin but includes a manipulated path. This can lead to the leakage of a one-time exchange code, enabling the attacker to obtain the victim's access and refresh tokens through the public API. Organizations using the affected versions should prioritize patching to version 4.7.3 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect (internal/service/auth/auth.go) that compares only the scheme and host of the client-supplied redirect_uri against the admin-configured allowlist, ignoring path, query, and fragment components. The redirect_uri is embedded into the signed state JWT at login time without validation. An attacker can craft a redirect_uri whose host matches an allowed origin but whose path is attacker-influenced; after the OAuth exchange the victim is redirected to that path with a one-time exchange code in the query string. If the code leaks (e.g., via Referer, analytics, or an open redirect on that host), the attacker can trade it at the public POST /api/auth/exchange endpoint for the victim's access and refresh tokens. Fixed in 4.7.3.