The field definition is

'callbackIsPrefix' => [
	'type' => 'check',
	'label-message' => 'mwoauth-consumer-callbackisprefix',
	'required' => true,
	'hide-if' => [ 'OR',
		[ '!==', 'ownerOnly', '' ],
		[ '===', 'oauthVersion', (string)Consumer::OAUTH_VERSION_2 ]
	],
],

and it has been the same since forever, but not checking that box definitely worked in the past. So I guess this is a change in how HTMLForm interprets that flag.

It was changed in rMWd36ea62c2015: Bury the reset preferences link: "Allow checkboxes to be "required" by fixing a detail in HTMLFormField::validate()".

This looks like a bug in OAuth to me, or is there a reason to specify 'required' => true there? I blamed to see why it was added and it looks like a copy-paste mistake in rEOAU489f34f72603: Allow adding custom parameters to the callback for OAuth..

You are right, it doesn't really make sense.

Change 793935 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/OAuth@master] Remove 'required' from callbackIsPrefix

https://gerrit.wikimedia.org/r/793935

Change 793935 merged by jenkins-bot:

[mediawiki/extensions/OAuth@master] Remove 'required' from callbackIsPrefix

https://gerrit.wikimedia.org/r/793935

Change 793795 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/OAuth@wmf/1.39.0-wmf.12] Remove 'required' from callbackIsPrefix

https://gerrit.wikimedia.org/r/793795

Change 793795 merged by jenkins-bot:

[mediawiki/extensions/OAuth@wmf/1.39.0-wmf.12] Remove 'required' from callbackIsPrefix

https://gerrit.wikimedia.org/r/793795

Mentioned in SAL (#wikimedia-operations) [2022-05-23T13:45:36Z] <tgr@deploy1002> Synchronized php-1.39.0-wmf.12/extensions/OAuth/src/Frontend/SpecialPages/SpecialMWOAuthConsumerRegistration.php: Backport: [[gerrit:793795|Remove 'required' from callbackIsPrefix (T308880)]] (duration: 00m 50s)