Threats tagged 'ghsa-29cx-77jg-5p59'

OpenAM versions from 14.5.1 up to but not including 16.1.4 contain a cross-site request forgery (CSRF) vulnerability in the OAuth 2.0 device authorization flow. This flaw allows attackers to approve device codes without user consent when consent is skipped for implied-consent clients. An attacker can initiate a device authorization and trick a logged-in user into visiting a malicious page, thereby obtaining access and ID tokens to impersonate the user in API calls.