Credential theft via unvalidated authorization redirect

Open redirect in Cloudflare Workers OAuth Provider before 0.0.5 allows remote attackers to steal OAuth credentials through a malicious redirect URI. The authorization-request parser accepted redirect_uri without comparing it with the registered client's redirectUris list, while validation occurred only at token exchange. Exploitation requires prior victim authorization, a callback that silently reauthorizes known clients, and user interaction with an attacker-controlled site.