CVE-2020-15233

CVE-2020-15233 describes a vulnerability in ORY Fosite versions 0.30.2 through 0.34.0, an OAuth2 & OpenID Connect framework for Go. An attacker can override a registered redirect URL by initiating an OAuth flow and requesting a loopback adapter redirect URL, allowing them to inject custom query parameters and override the redirect host. This medium-severity vulnerability (CVSS 4.8) requires the attacker to have access to the loopback interface, with potential for low impact on confidentiality and integrity. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.