23 ms·

However, stealing access tokens is only possible with public clients. The open redirect works on both public and confidential clients.