Incorrect param parsing in Digits web authentication

Hi, I would like to report an issue on Digits web authentication which allows attackers to retrieve the OAuth credential data of an application victims authorized.

              return window.location.search.slice(1).split("&").forEach(function(e) {
                    var n = e.split("=");
                    t[n[0]] = window.unescape(n[1])
                })