Threats tagged 'ghsa-qqcj-rghw-829x'

A critical authentication bypass vulnerability exists in the Unity Catalog server's token exchange endpoint. The endpoint dynamically fetches the JWKS endpoint based on the issuer (iss) claim in incoming JWTs without verifying that the issuer is a trusted identity provider. This allows an attacker to create a malicious JWT signed by their own key, impersonate any user, and gain full access to that user's resources. The vulnerability also involves missing validation of the audience (aud) claim, enabling tokens intended for other services to be accepted. A fix is available in version 0.4.1.