Comment by matja

RFC 6749 goes into details on how the authorization server should prevent this type of attack

    The authorization server MUST require public clients and SHOULD require
    confidential clients to register their redirection URIs.  If a redirection
    URI is provided in the request, the authorization server MUST validate it
    against the registered value.

So how is this possible, when presumably the Harvest app did not register the malicious redirect_uri?

Does the Microsoft OAuth server ignore URL parameters within a redirect_uri when comparing with registered redirect URIs for the OAuth client?