Incorrect Regular Expression

Summary

Authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are configured in a provider, authentik will automatically use the first "redirect_uri" value received as an allowed redirect URI, without escaping characters that have a special meaning in RegEx. Similarly, the documentation did not take this into consideration either. Given a provider with the Redirect URIs set to https://foo.example.com, an attacker can register a domain fooaexample.com, and it will correctly pass validation. As a workaround, when configuring OAuth2 providers, make sure to escape any wildcard characters that are not intended to function as a wildcard; for example, replace `.` with `\.`.