Assume the redirect URL pattern https://*.somesite.example/* is
   registered for the client with the client ID s6BhdRkqt3.  The
   intention is to allow any subdomain of somesite.example to be a valid
   redirect URI for the client, for example
   https://app1.somesite.example/redirect.  A naive implementation on
   the authorization server, however, might interpret the wildcard * as
   "any character" and not "any character valid for a domain name".  The
   authorization server, therefore, might permit
   https://attacker.example/.somesite.example as a redirect URI,
   although attacker.example is a different domain potentially
   controlled by a malicious party.