CVE-2026-19078: Ose-oauth-server: oauth-server: open redirect vulnerability enables phishing via unvalidated parameter.
Published Aug 11, 2026
·Updated
A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an attacker-controlled website. This could enable phishing attacks, potentially tricking users into revealing sensitive information.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the grant approval handler logic to validate the 'then' parameter and reject/ignore values that would cause an open redirect (redirect only to expected, trusted destinations).
oauth-server (Ose-oauth-server) grant approval handler 'then' parameter validation = properly validate/allowlist the 'then' parameter so it cannot redirect to attacker-controlled URLs
Event History
Aug 11, 2026
CVE Published
via MITRE·03:34 PM
Data Sourced
via MITRE·03:34 PM
DescriptionSeverityWeakness