Threats tagged 'ghsa-39hr-239p-fhqc'

A vulnerability in OpenAM OAuth2 prior to version 16.0.3 allows arbitrary injection of OIDC requested claims values into the id_token and user_info responses when the claims_parameter_supported feature is enabled. This flaw permits attackers to customize claims such as email addresses, potentially enabling identity spoofing if clients rely on these claims for user identification.