Hacker News Reader

tl;dr: it was an open redirect.

No, it wasn’t.

It’s not validating reused codes or tokens from an application owned by attacker.

True, thanks for noticing. I re-read it more carefully