I had the same problem. According to the authentication docs‡:
In order to get access_token and expires (if applicable) wrapped in a JSON object, POST to https://stackoverflow.com/oauth/access_token/json instead.
‡ Now. The Doc pages did not say this back in 2013.
