{"id":"GHSA-grfp-q2mm-hfp6","summary":"Redirect URL matching ignores character casing","details":"### Impact\n\nBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using `strings.ToLower` while they should have been compared with a simple string match:\n\n1. Registering a client with allowed redirect URL `https://example.com/callback`\n2. Performing OAuth2 flow and requesting redirect URL `https://example.com/CALLBACK`\n3. Instead of an error (invalid redirect URL), the browser is redirected to `https://example.com/CALLBACK` with a potentially successful OAuth2 response, depending on the state of the overall OAuth2 flow (the user might still deny the request for example).","aliases":["CVE-2020-15234"],"modified":"2026-09-10T03:49:26.784913554Z","published":"2021-05-24T17:00:05Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2021-05-21T22:15:37Z","nvd_published_at":"2020-10-02T21:15:00Z","cwe_ids":["CWE-178","CWE-20","CWE-601"]},"references":[{"type":"WEB","url":"https://github.com/ory/fosite/security/advisories/GHSA-grfp-q2mm-hfp6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15234"},{"type":"WEB","url":"https://github.com/ory/fosite/commit/cdee51ebe721bfc8acca0fd0b86b030ca70867bf"},{"type":"PACKAGE","url":"https://github.com/ory/fosite"}],"affected":[{"package":{"name":"github.com/ory/fosite","ecosystem":"Go","purl":"pkg:golang/github.com/ory/fosite"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.34.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-grfp-q2mm-hfp6/GHSA-grfp-q2mm-hfp6.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N"}]}