Several weeks ago when I was researching how to be an OAuth2.0 provider, I found the following potential vulnerability when a user is requesting an access token from OAuth provider.
Senario:
If user A requests a authentication code with state=1234 and he gets redirected to: http://abc.com/callback?state=1234&code=9IDE3F
If user B requests a authentication code with state=5678 and he gets redirected to: http://abc.com/callback?state=5678&code=3R34TG