Authorization Code Theft via Unvalidated redirect_uri

The XWiki OIDC Provider extension does not validate the redirect_uri parameter in authorization requests against any pre-registered value for the given client_id. It also does not enforce confidential client authentication (i.e., no client_secret is required at the token endpoint) neither does it enforce client registration. This allows an attacker to craft an authorization URL that, when clicked and approved by an authenticated XWiki user, redirects the resulting authorization code to an attacker-controlled server. The attacker can then exchange this code for an access token and gain unauthorized access to the victim's identity and data.

Root Causes

1. No redirect_uri validation: The /oidc/authorization endpoint accepts any redirect_uri value, regardless of what (if anything) was registered for the given client_id (e.g. through the /oidc/register endpoint). An attacker can substitute their own server.
2. No confidential client enforcement: The OIDC provider does not require a client_secret when exchanging an authorization code for a token. This means the stolen code can be exchanged by anyone, not just the legitimate client.
3. Unregistered clients accepted by default: There is no mechanism (or it is not enabled by default) for administrators to restrict authorization to pre-registered clients only.

Proof of concept

Attached is a screenshot demonstrating this vulnerability on openDesk.
Any user going through this OAuth flow would have their access token redirected to a malicious domain.