You are right that redirect_uri must match the exact registered redirect_uri. But some providers allow query parameters. For Microsoft, it was possible in 2020

You are right that redirect_uri must match the exact registered redirect_uri. But some providers allow query parameters. For Microsoft, it was possible in 2020 when I reported the vulnerability. In 2022, they restricted query parameter support to only applications that is built for Work and School accounts and in August 2022, they added a section for this in the documentation. See: - Commit: https://github.com/MicrosoftDocs/azure-docs/commit/c249a0548d0a6d230f57bb132e1cf3e1d51ba977 https://github.com/MicrosoftDocs/azure-docs/commit/c249a0548... - Current Documentation: https://learn.microsoft.com/en-us/azure/active-directory/develop/reply-url#query-parameter-support-in-redirect-uris https://learn.microsoft.com/en-us/azure/active-directory/dev...