GHSA-P64J-F4X9-WQ66: OAuth Redirect URI Path Truncation in Ech0 Leads to Authorization Code Theft Vulnerability ID: GHSA-P64J-F4X9-WQ66 CVSS Score: 8.1 Published: 2026-05-07 The Ech0 lightweight publishing platform contains a critical vulnerability in its OAuth 2.0 implementation where redirect URI validation ignores the path component. This oversight permits attackers to route authenticated victims to malicious endpoints on trusted domains, resulting in the theft of authorization codes and subsequent account takeover. TL;DR Improper validation of OAuth redirect URIs in Ech0 allows attackers to append malicious paths to trusted domains. Exploitation leads to the theft of authorization exchange codes and full account takeover.…