CVE-2026-19078: OAuth Server Auth Bypass Vulnerability

CVE-2026-19078 Overview

CVE-2026-19078 is an open redirect vulnerability [CWE-601] in the oauth-server component. The flaw stems from insufficient validation of the then parameter in the grant approval handler. An attacker can craft a malicious URL that redirects an authenticated user to an attacker-controlled site after they approve or deny an OAuth grant request. The redirect occurs under the trusted authorization server domain, which increases the credibility of downstream phishing attempts.

Critical Impact
Attackers can leverage the trusted authorization server domain to redirect users to phishing sites and harvest credentials or sensitive information after grant approval or denial.

Affected Products

Red Hat oauth-server component (see Red Hat CVE-2026-19078 Advisory)
Specific affected package versions: refer to the Red Hat Bug Report #2511975

Discovery Timeline

2026-08-11 - CVE-2026-19078 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-19078

Vulnerability Analysis

The vulnerability resides in the OAuth grant approval handler within the oauth-server component. When a user interacts with the consent page, the handler processes a then parameter that specifies where to send the user after the approve or deny action completes. The handler does not validate that the destination points to an allowed origin. As a result, an attacker who controls the then value can force a redirect to any external host.

Because the redirect originates from the authorization server, users see a trusted domain in the initial URL. This misplaced trust is the mechanism that makes open redirect flaws useful for phishing, session token theft through follow-on OAuth flows, and malware delivery. The Common Weakness Enumeration classifies this issue as [CWE-601] URL Redirection to Untrusted Site.

Root Cause

The root cause is missing allowlist validation of the then query parameter. The grant approval handler treats user-supplied redirect targets as trusted and issues an HTTP redirect response without confirming the destination matches a permitted host, path, or scheme. Proper handling requires comparing the target against a fixed set of relative paths or a strict allowlist of absolute URLs bound to the authorization server.

Attack Vector

Exploitation requires network access to the authorization endpoint and user interaction. An attacker sends a victim a crafted authorization URL that embeds an attacker-controlled value in the then parameter. The victim authenticates, then approves or denies the grant. The server issues a redirect to the attacker-controlled site, where the attacker presents a spoofed login page, fake consent screen, or malicious download. Refer to the Red Hat CVE-2026-19078 Advisory for parameter-specific technical detail.

Detection Methods for CVE-2026-19078

Indicators of Compromise

Authorization server access logs containing then parameter values pointing to external or unexpected hosts
HTTP 302 responses from the grant approval endpoint with Location headers referencing domains outside the organization
User reports of unexpected redirects or credential prompts following legitimate OAuth consent flows
Referer headers on downstream phishing pages that trace back to the trusted oauth-server consent URL

Detection Strategies

Parse authorization server logs for the grant approval endpoint and flag requests where the then parameter contains absolute URLs or non-allowlisted paths
Alert on any Location header issued by oauth-server that resolves to a host outside the organization's registered client domains
Correlate consent page requests with subsequent DNS lookups to newly registered or low-reputation domains

Monitoring Recommendations

Enable verbose request logging on the oauth-server grant approval handler and forward events to a centralized analytics platform
Baseline normal then parameter values and generate alerts when observed values deviate from the baseline
Monitor phishing intelligence feeds for lookalike domains that could be paired with an open redirect through the authorization server

How to Mitigate CVE-2026-19078

Immediate Actions Required

Apply vendor updates for the oauth-server component as published in the Red Hat CVE-2026-19078 Advisory
Audit authorization server access logs for prior use of external then parameter values and identify potentially affected users
Notify users of the phishing risk and instruct them to verify URLs before entering credentials after any OAuth consent action

Patch Information

Refer to the Red Hat CVE-2026-19078 Advisory and the Red Hat Bug Report #2511975 for the current list of fixed package versions and errata. Apply the vendor-supplied patches through the standard update channels for the affected distribution.

Workarounds

Restrict the grant approval handler to accept only relative paths in the then parameter using a reverse proxy or web application firewall rule
Enforce a strict allowlist of permitted redirect destinations bound to registered OAuth client domains
Strip or reject requests where the then parameter contains a scheme (http://, https://) or protocol-relative prefix (//) at the edge

bash

# Example WAF rule concept: reject external then parameter values at the edge
# (Adapt to your WAF syntax; this is illustrative only)
SecRule ARGS:then "@rx ^(https?:|//)" \
    "id:1026190780,phase:2,deny,status:400,\
    msg:'CVE-2026-19078: External redirect target rejected in then parameter'"