CVE-2020-15234: URL Redirection to Untrusted Site (Open Redirect)

ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite, the OAuth Client’s registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using strings.ToLower while they should have been compared with a simple string match. This allows an attacker to register a client with allowed redirect URL.