From 9023b9b8bbaff8d802d9cdfcc119e4213f599324 Mon Sep 17 00:00:00 2001
From: David Kocher <dkocher@iterate.ch>
Date: Tue, 28 Apr 2026 11:56:55 +0200
Subject: [PATCH] Assign random port number when not explicitly set in redirect
 URI.

---
 .../core/oauth/LoopbackOAuth2AuthorizationCodeProvider.java     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/oauth/src/main/java/ch/cyberduck/core/oauth/LoopbackOAuth2AuthorizationCodeProvider.java b/oauth/src/main/java/ch/cyberduck/core/oauth/LoopbackOAuth2AuthorizationCodeProvider.java
index 65e73dfdc9..4f1390ea1b 100644
--- a/oauth/src/main/java/ch/cyberduck/core/oauth/LoopbackOAuth2AuthorizationCodeProvider.java
+++ b/oauth/src/main/java/ch/cyberduck/core/oauth/LoopbackOAuth2AuthorizationCodeProvider.java
@@ -67,7 +67,7 @@ public class LoopbackOAuth2AuthorizationCodeProvider extends BrowserOAuth2Author
         });
         try {
             final HttpServer server = HttpServer.create(new InetSocketAddress(
-                    URI.create(redirectUri).getHost(), URI.create(redirectUri).getPort()), 0);
+                    URI.create(redirectUri).getHost(), -1 == URI.create(redirectUri).getPort() ? 0 : URI.create(redirectUri).getPort()), 0);
             final ExecutorService executor = Executors.newSingleThreadExecutor(new NamedThreadFactory("oauth"));
             // Create handler for OAuth callback
             server.createContext(StringUtils.isBlank(URI.create(redirectUri).getRawPath()) ?