If you're asking in good faith,

> Every line was thoroughly reviewed and cross-referenced with relevant RFCs

The issue in the CVE comes from direct contradiction of the RFC. The RFC says you MUST check redirect uris (and, as anyone who's ever worked with oauth knows, all the functionality around redirect uris is a staple of how oauth works in the first place -- this isn't some obscure edge case). They didn't make a mistake, they simply did not implement this part of the spec.

When they said every line was "thoroughly reviewed" and "cross referenced", yes, they lied.