CVE-2026-79662: URL Redirection to Untrusted Site ('Open Redirect') in lin-snow Ech0

CVE-2026-79662 is an open redirect vulnerability in lin-snow Ech0 through version 4.5.6. The OAuth redirect URI validation function parseAndValidateClientRedirect only compares the scheme and host of the client-supplied redirect_uri against an admin-configured allowlist, ignoring the path, query, and fragment components. The redirect_uri is embedded into a signed state JWT at login without further validation. An attacker can craft a redirect_uri with a host matching an allowed origin but with an attacker-controlled path. After the OAuth exchange, the victim is redirected to this path with a one-time exchange code in the query string. If this code leaks through referer headers, analytics, or an open redirect on that host, the attacker can use it at the public POST /api/auth/exchange endpoint to obtain the victim's access and refresh tokens. The vulnerability is fixed in Ech0 version 4.7.3.

An attacker can exploit this vulnerability to obtain OAuth access and refresh tokens of a victim by tricking them into following a malicious redirect_uri that appears to be from an allowed host but contains an attacker-controlled path. This can lead to unauthorized access to the victim's account or data. The vulnerability requires user interaction and has a high complexity due to the need to leak the one-time exchange code. There are no known exploits in the wild at this time.

Upgrade Ech0 to version 4.7.3 or later, where this vulnerability is fixed. Until then, avoid using OAuth redirect URIs that rely solely on scheme and host validation. Monitor for suspicious redirect_uri usage. Patch status is not explicitly stated in the vendor advisory, but the fix is confirmed in version 4.7.3.