Ech0's OAuth redirect URI validation is flawed because it only compares the scheme and host of redirect URIs against an allowlist, ignoring the path, query, and fragment components. This allows an attacker to craft a redirect URI with an allowed host but an attacker-controlled path, enabling theft of the OAuth exchange code. The attacker can then exchange this code for the victim's access and refresh tokens. This vulnerability violates RFC 6749 §3.1.2, which requires exact redirect URI matching. A fix is available in version 1.4.8-0.20260503040728-a7e8b8e84bd1.