page.line.me Open Redirect Leading to OAuth Authorization Code Exposure and Access Token Compromise

Summary

An open redirect vulnerability was identified in page.line.me because redirect destinations were not properly restricted to trusted domains. By abusing this behavior within an OAuth 2.0 authorization flow, an attacker could cause the authorization response to be sent to an attacker-controlled endpoint. This could expose the authorization code issued after successful user authentication, which may then be exchanged for a valid access token. As a result, the vulnerability could lead to unauthorized access to the victim’s account, allowing an attacker to perform actions with the victim’s privileges.