Glewlwyd SSO server 2.x up to and including 2.7.6 allows open redirection via redirect_uri.
glewlwyd sso server project glewlwyd sso server