CVE-2026-116194: Oauth Callback Value Persisted Or Url Built Without Allowlistcve-2026-116194-oauth-callback-value-persisted-or-url-built-without-allowlist
A value read from an OAuth callback form ($REQ.Form.Get / $REQ.FormValue) flows into persistent configuration ($CFG.Set) or into an http(s) URL without being checked against an allowlist. The localhost OAuth callback is an unauthenticated endpoint (any web page in the user's browser can request it while the flow is waiting), so a forged callback can plant an
