IME Wildcard redirect URLs have become more common in recent years due to the rise of preview environments. If you're deploying a git branch to Vercel, and you now want to log in to <project-name>-git-<branch-name>-<scope-slug>.vercel.app, then you don't want to bother with configuring a different redirect URL for every branch name. Enter the wildcard.

Ideally wildcards are only used in dev/staging environments, but if the system allows for misconfiguration, the system will be misconfigured.

It's pretty common in my experience, especially at places that have multiple "apps" behind the same auth.

I've seen it in multiple installs, and it's used by keycloak's default clients used for the admin app and for the account portals for realms.

I use it to allow a ?next={url} query parameter in the redirect so I can send users to the page they originally wanted to visit. It becomes more important the faster the access tokens expire because a user can reauth multiple times in a session.

The other way might be to put that URL in redis or something, maybe that's better?

However, stealing access tokens is only possible with public clients. The open redirect works on both public and confidential clients.