Allowed Callback URLs validation is incorrect

That’s fine, I guess, but this is clearly a bug.