diff --git a/ui/commons/src/main/resources/oauthReturn.html b/ui/commons/src/main/resources/oauthReturn.html
index 0b7c4d66e..7ec8a9ec2 100644
--- a/ui/commons/src/main/resources/oauthReturn.html
+++ b/ui/commons/src/main/resources/oauthReturn.html
@@ -1,3 +1,6 @@
+<!-- Copyright 2015 ForgeRock AS.
+	License terms: https://forgerock.org/cddlv1-0/
+	Portions Copyrighted 2026 3A Systems, LLC -->
 <script>
 (function () {
     /**
@@ -14,15 +17,22 @@
         This step is necessary because IDPs do not allow you to specify a redirect URI with
         a hash fragment; this file works around that requirement.
     */
-    var queryParams = window.location.search.replace("?", "").split("&").reduce(function (map, item) {
+    // Look up a single query parameter by name. Reading only the known
+    // parameters avoids writing map entries keyed by user input (CWE-1321).
+    function getQueryParam(name) {
+        var value;
+        window.location.search.replace("?", "").split("&").forEach(function (item) {
             var parts = item.split("=");
-            map[parts[0]] = decodeURIComponent(parts[1]);
-            return map;
-        }, {});
+            if (parts[0] === name) {
+                value = decodeURIComponent(parts[1]);
+            }
+        });
+        return value;
+    }
 
     window.location.href = window.location.href
-        // queryParams.state is expected to be the URL fragment plus any other
+        // the "state" parameter is expected to be the URL fragment plus any other
         // details necessary to resume the oauth process
-        .replace(/oauthReturn\.html.*/, "#" + queryParams.state + "&code=" + queryParams.code);
+        .replace(/oauthReturn\.html.*/, "#" + getQueryParam("state") + "&code=" + getQueryParam("code"));
 }())
 </script>
diff --git a/ui/mock/src/main/resources/mockOAuthAuthorization.html b/ui/mock/src/main/resources/mockOAuthAuthorization.html
index 4d32c129b..7f28e6662 100644
--- a/ui/mock/src/main/resources/mockOAuthAuthorization.html
+++ b/ui/mock/src/main/resources/mockOAuthAuthorization.html
@@ -1,5 +1,8 @@
 
 
+<!-- Copyright 2015 ForgeRock AS.
+	License terms: https://forgerock.org/cddlv1-0/
+	Portions Copyrighted 2026 3A Systems, LLC -->
 <body>
 
 Mock OAuth Provider redirecting in <span id="countDown"></span>....
@@ -9,18 +12,55 @@
 
 <script>
 (function () {
-    var queryParams = window.location.search.replace("?", "").split("&").reduce(function (map, item) {
+    // Look up a single query parameter by name. Reading only the known
+    // parameters avoids writing map entries keyed by user input (CWE-1321).
+    function getQueryParam(name) {
+        var value;
+        window.location.search.replace("?", "").split("&").forEach(function (item) {
             var parts = item.split("=");
-            map[parts[0]] = decodeURIComponent(parts[1]);
-            return map;
-        }, {}),
-        countDown = 3;
+            if (parts[0] === name) {
+                value = decodeURIComponent(parts[1]);
+            }
+        });
+        return value;
+    }
 
-    setInterval(function () {
+    // The mock provider only ever redirects back into the application that
+    // initiated the flow, so resolve redirect_uri against the current
+    // document and rebuild it on our own origin. Cross-origin targets and
+    // non-http schemes (e.g. javascript:) are rejected (CWE-79, CWE-601).
+    function getSafeRedirectUri() {
+        var redirectUri = getQueryParam("redirect_uri");
+        if (!redirectUri) {
+            return undefined;
+        }
+        var url;
+        try {
+            url = new URL(redirectUri, window.location.href);
+        } catch (e) {
+            return undefined;
+        }
+        if (url.origin !== window.location.origin) {
+            return undefined;
+        }
+        // Any query or fragment on the incoming redirect_uri is dropped
+        // deliberately: the caller appends its own ?code=...&state=... below.
+        return url.origin + url.pathname;
+    }
+
+    var countDown = 3;
+
+    var timer = setInterval(function () {
         document.getElementById("countDown").innerHTML = countDown;
         countDown--;
         if (countDown <= 0) {
-            window.location.href=queryParams.redirect_uri + "?code=randomAccessCode&state=" + encodeURIComponent(queryParams.state);
+            clearInterval(timer);
+            var redirectUri = getSafeRedirectUri();
+            if (redirectUri) {
+                window.location.href=redirectUri + "?code=randomAccessCode&state=" + encodeURIComponent(getQueryParam("state"));
+            } else {
+                document.body.innerHTML = "Invalid redirect_uri";
+            }
         }
     }, 1000);
     document.getElementById("countDown").innerHTML = countDown+1;
