Confused Deputy Problem (also known as 'The Devil Wears Prada') is an OAuth 2 vulnerability arising when the protocol is used for authentication. Essentially, a malicious client obtains a token for a user, and presents this to a second client. If the second client accepts tokens as proof of authentication, than the malicious client can authenticate himself as the user towards another client.
In most explanations of this vulnerability, such as http://blog.intothesymmetry.com/2013/05/oauth-2-attacks-introducing-devil-wears.html and OAuth implicit flow and confused deputy problem, it is suggested that this only works for the implicit flow.
However, wouldn't the authorization code flow suffer from the same problem? It seems that a malicious client can obtain an authorization code for a user, and then offer that authorization code to a second client. The second client now does a backchannel request to the authorization server, and upon completion the second client believes it is communicating with the user rather than with the malicious client.
Is this analysis correct?