Authentication bypass via token-bearing open redirect

Authentication bypass in Strapi 4.24.1 and earlier allows remote attackers to steal third-party tokens through a malicious link. The users-permissions authentication controller preserves an attacker-supplied callback URL in the session and appends the provider access token to that redirect as a query parameter. One user click and a third-party provider without strict callback validation expose the token, which can be exchanged for a Strapi JWT and unauthorized API access.