Open Redirect via Unvalidated redirect_uri

The normal authentication flow validates the redirect_uri parameter against registered OAuth clients in the controller method body. However, Jakarta Bean Validation annotations on request parameters (such as @Pattern on state, nonce, code_challenge, and code_challenge_method) are evaluated before the controller body executes.

In the normal flow, the redirect_uri is validated against registered clients:

idpAuthenticator.validateRedirectUri(clientId, redirectUri);

But this validation is inside the controller method body. When Jakarta Bean Validation annotations on parameters fail, a ConstraintViolationException is thrown before the controller body executes. The exception is handled by buildForwardingError, which reads the redirect_uri directly from the HTTP request and uses it for a 302 redirect, without ever calling validateRedirectUri:

final String redirectUri = request.getParameter("redirect_uri");
if (redirectUri == null) {
    // ... return 400
} else {
    final UriBuilder uriBuilder = UriBuilder.fromPath(redirectUri)
        .queryParam("error", ...)
        .queryParam("gematik_code", ...);
    // ...
    response.setHeader(HttpHeaders.LOCATION, location.toString());
    return new ResponseEntity<>(HttpStatus.FOUND);
}

The redirect_uri validation in createIdpErrorResponse only applies to MissingServletRequestParameterException, not to ConstraintViolationException. Any request that triggers a parameter format validation error will redirect to whatever redirect_uri the attacker supplies.

An attacker can exploit this by sending a request with a valid client_id but an intentionally malformed code_challenge. The value fails the expected regex pattern, triggering error code 2010 with HTTP status 302. The error handler then redirects the user to the attacker-controlled URL:

curl -v 'https://idp.example.com/sign_response?\
  client_id=eRezeptApp&\
  redirect_uri=https://evil.com&\
  response_type=code&\
  scope=openid+e-rezept&\
  code_challenge=too_short&\
  code_challenge_method=S256&\
  state=x&nonce=y'