The vulnerability in Punk::OAuth2 before version 0.03 involves the same_origin_path function accepting backslash and tab characters in the return parameter used for post-login redirection. Since URL parsing treats backslashes as slashes and strips tabs, an attacker can craft a URL that appears to redirect within the application but actually redirects to an external, attacker-controlled domain. This results in an open redirect (CWE-601) that occurs after a legitimate login, potentially facilitating phishing or other social engineering attacks. No authorization tokens or codes are leaked through this redirect.

An attacker can craft a login URL that, after successful authentication, redirects the user to a malicious external site. Although no authorization codes or access tokens are exposed, this open redirect can be used for phishing or to trick users into interacting with attacker-controlled content under the guise of a trusted application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using vulnerable versions of Punk::OAuth2 and carefully validate or sanitize return parameters in their own implementations to prevent open redirects.