Ech0 4.5.6 and earlier contain a redirect URI validation flaw. The parseAndValidateClientRedirect function checks only the scheme and host of the redirect_uri, ignoring path, query, and fragment components. Consequently an attacker can provide a redirect_uri whose host matches an allowed origin but whose path is attacker‑controlled. After the OAuth flow the victim is redirected to that path with the one‑time exchange code appended. If the code leaks—through the Referer header, analytics, or another open redirect—the attacker can post the code to the public /api/auth/exchange endpoint and obtain the victim’s access and refresh tokens. This results in credential theft and unauthorized access, leveraging an Open Redirect weakness (CWE‑601).

The affected product is Ech0 from the vendor lin-snow. All Ech0 releases up to and including version 4.5.6 are vulnerable. The issue was fixed in release 4.7.3, so affected versions are 4.5.6 and earlier, and any unpatched installations that have not applied the 4.7.3 or later patch should be considered at risk.

The vulnerability carries a CVSS score of 8.8, indicating a high severity. EPSS is unavailable, so the exploitation probability is unknown, but the flaw is exploitable via crafted OAuth requests, meaning that any user who initiates an OAuth login to the affected application is a potential victim. The issue is not listed in the CISA KEV catalog, but its impact on OAuth token integrity makes it a significant risk. An attacker does not need any privileged access—simply control the redirect_uri supplied to the client and derive the one‑time code from the resulting redirect. Once the code is intercepted, the attacker can retrieve tokens at the public exchange endpoint and impersonate the user.