CVE-2020-15234

CVE-2020-15234 is a medium-severity vulnerability affecting ORY Fosite, an OAuth2 & OpenID Connect framework for Go, specifically versions prior to 0.34.1. The flaw stems from an improper case-insensitive comparison of redirect URLs, allowing an attacker to register a client with a valid URL (e.g., https://example.com/callback) and then bypass validation by requesting a case-modified version (e.g., https://example.com/CALLBACK). This could lead to a successful OAuth2 response being sent to an unintended, albeit case-modified, redirect URL, potentially resulting in information disclosure (C:L) and integrity impact (I:L). The attack requires high privileges (PR:H) and user interaction (UI:R), with low attack complexity (AC:L) over a network (AV:N). There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.