CVE-2020-26877

Vulnerability

ApiFest OAuth 2.0 Server version 0.3.1 does not validate the redirect_uri parameter against registered client URIs as required by RFC 6749 [1]. Consequently, an authorization code is sent to any URI supplied in the authorization request, even if it does not belong to the legitimate client. This violates OAuth 2.0 specification section 3.1.2.3 [1].

Exploitation

An attacker can craft an authorization request with a manipulated redirect_uri pointing to an attacker-controlled endpoint. When the legitimate user authorizes, the server redirects the browser to the attacker's URI with the authorization code appended. No authentication or prior access is needed for the attacker beyond the ability to initiate the authorization flow.

Impact

Successful exploitation allows the attacker to capture the authorization code. Combined with the client credentials (if known) or by other means, the attacker could potentially exchange the code for an access token, leading to unauthorized access to the user's resources. The attack compromises confidentiality and may enable further account takeover.

Mitigation

No updated version has been released addressing this issue. The project appears to be unmaintained; the GitHub repository [2] shows no recent activity. As a workaround, implement custom validation of the redirect_uri in the authorization endpoint, or switch to a maintained OAuth 2.0 server. This CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog.