OAuth 2.0 and OpenID have serious Covert Redirect vulnerability.
http://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html