diff --git a/changelog.d/2421.bugfix.md b/changelog.d/2421.bugfix.md
new file mode 100644
index 000000000..f5c1e842d
--- /dev/null
+++ b/changelog.d/2421.bugfix.md
@@ -0,0 +1 @@
+Redirect URIs in OAuth clients' metadata are now properly validated to be on a subdomain of the OAuth issuer URL domain. Contributed by @ginger.