Threats tagged 'ghsa-m4pq-7mr3-263j'

Zipline versions from 4.2.0 up to but not including 4.6.2 have an information disclosure vulnerability where sensitive environment variables, including OAuth2 client secrets, are logged without redaction at startup. This allows attackers with access to system or Docker logs to retrieve these secrets and potentially exchange intercepted OAuth2 callbacks for valid tokens.