OAuth 2.0 and OpenID have serious Covert Redirect vulnerability. http://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html