Codex fails to handle OAuth callback due to missing required issuer in the response validation.
Codex fails to handle OAuth callback due to missing required issuer in the response validation.
Problem statement normalized from the linked evidence
CANDIDATE VIEW · NOT A PUBLISHED OPPORTUNITY
01
Qualification checklist
Gate decision: Aug 15, 2026
✓
At least 3 independent users3 / 3
MET
×
At least 2 independent discussions1 / 2
NOT MET
✓
At least 1 supporting signal2 Workarounds · 1 Blocked workflows · Persistence
MET
02
Observed signals
Users3
Discussions1
Mentions3
Active days2
Source coverageGitHub
TrendUNKNOWN
First seenJul 15, 2026
Last seenJul 26, 2026
Why the gate is holding
Fewer than 2 independent discussions
Competition research, commercial scoring, and Build Gap analysis do not run until this gate passes.
03
Source evidence
3 evidence records
github · HIGH · Jul 26, 2026
openai/codex
Confirmed against **[mcp-sso](https://github.com/acartag7/mcp-sso)** (an open-source OAuth 2.1 / SSO layer for MCP servers) on Codex CLI **0.144.1**. mcp-sso is fully RFC 9207-compliant — it advertises `authorization_response_iss_parameter_supported: true` and returns a correct `iss` on the authorization response. I captured the exact redirect Codex's loopback listener receives: ``` http://127.0.0.1: /callback/ ?code= &iss=https%3A%2F%2F &state= ``` `iss` is present and decodes to precisely the issuer Codex reports…
Independent reproduction on Codex CLI `0.144.4` using an RFC 9207-compatible authorization server. The flow is a standard MCP OAuth authorization-code flow with PKCE: 1. Codex discovers the authorization server through the MCP protected-resource metadata. 2. Authorization-server metadata includes an `issuer` and `authorization_response_iss_parameter_supported: true`. 3. The authorization server redirects to Codex's loopback callback with `code`, `state`, and a percent-encoded `iss` exactly matching the discovered i…