CVE-2026-28512: Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion

A flaw in callback URL validation allowed crafted redirect_uri values containing URL userinfo (@) to bypass legitimate callback pattern checks. If an attacker can trick a user into opening a malicious authorization link, the authorization code may be redirected to an attacker-controlled host.