Threats tagged 'ghsa-7hjx-472h-3f7q'

Apache CXF contains a vulnerability in its JwtRequestCodeFilter where security-sensitive parameters from a signed JWT are copied into the authorization parameter map without proper exclusion. This allows an attacker who can produce a validly-signed JWT (for example, if the client_secret is compromised) to substitute critical parameters such as code_challenge, code_challenge_method, nonce, and state, undermining PKCE integrity and OpenID Connect replay protection. Fixed versions 4.2.3, 4.1.8, and 3.6.12 address this issue.