Authorization token theft via injected redirect domain

Open redirect in Zscaler Client Connector allows remote authenticated users to steal authorization tokens during ZIA enrollment. The login flow accepted an attacker-supplied domain in a URL parameter and redirected the post-authentication callback, sending the token to that domain. Exploitation requires a user enrollment authentication flow and control of the injected redirect domain; the documented consequence is authorization-token disclosure.