Threats tagged 'ghsa-4j7m-6fr6-j463'

ZITADEL versions 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 have a missing authorization vulnerability in the Login V2 component. This flaw allows attackers to approve OAuth 2.0 device authorizations using a victim's active session without their consent. By sending a signed-in user a specially crafted link containing the attacker's user code, the attacker can obtain the victim's tokens and bypass project access controls via the OIDC device authorization API.