Reflected XSS in OAuth complete endpoints