GHSA-P64J-F4X9-WQ66: OAuth Redirect URI Path Truncation in Ech0 Leads to Authorization Code Theft

Vulnerability ID: GHSA-P64J-F4X9-WQ66

CVSS Score: 8.1

Published: 2026-05-07

The Ech0 lightweight publishing platform contains a critical vulnerability in its OAuth 2.0 implementation where redirect URI validation ignores the path component. This oversight permits attackers to route authenticated victims to malicious endpoints on trusted domains, resulting in the theft of authorization codes and subsequent account takeover.

TL;DR

Improper validation of OAuth redirect URIs in Ech0 allows attackers to append malicious paths to trusted domains.…