Threats tagged 'ghsa-8x2m-938h-j94g'

A vulnerability in the search-v2-api component allows authentication bypass when a request includes an 'Upgrade: websocket' header. An unauthenticated attacker can send a crafted HTTP POST request to the /federated endpoint with this header to bypass authentication and access federated search results across all configured remote managed hubs, leading to information disclosure.