Authorization server accepts unregistered redirect_uri
The /authorize endpoint delivered a response to a redirect_uri the client never registered.
What it means
OAuth 2.1 Section 2.3.1 requires exact-match comparison of redirect_uri against the set registered with the client. A server that accepts a redirect_uri the client never registered turns itself into an open redirector and lets an attacker exfiltrate authorization codes to any host they control. The check registers a client with redirect_uri=http://127.0.0.1:33419/callback, then sends /authorize with redirect_uri=https://attacker.example.com/callback. If the server redirects to the attacker host or issues a code, REDIRECT-002 fires critical.
How to fix
Validate redirect_uri with an exact-string comparison against the client's registered redirect_uris, including scheme, host, port, path and trailing slash. Reject with error=invalid_request when no entry matches. Do not perform substring, prefix or host-only comparison.
Spec
OAuth 2.1 Section 2.3.1See it live
Our demo MCP server trips REDIRECT-002 on purpose. Scan it and you'll see this exact finding with evidence and fix text.
npx -y @patchbay-nebius/agent audit https://demo.patchbay-mcp.dev/mcp --probe-headless-oauthThe --probe-headless-oauth flag is opt-in because it sends crafted authorize requests; safe against our demo, do not point it at production servers you don't own.
Run the check against your own server:
npx -y @patchbay-nebius/agent audit <url-or-directory>No install: scan an MCP server in the browser and get a shareable report.
Disagree with this finding on your server? Open an issue with the --json output. False-positive reports are the most useful feedback.