Threats tagged 'ghsa-pwwh-3685-58r7'

Apache CXF's OAuth2 Dynamic Client Registration endpoint improperly accepts and stores the 'scope' parameter from client registration requests without validating it against an allowlist. This allows clients to self-assign privileged scopes during registration. The issue affects multiple versions prior to 3.6.12, 4.1.8, and 4.2.3. Users are advised to upgrade to these fixed versions to mitigate the vulnerability.