A vulnerability in Action Pack's Parameters#each_key method allows a possible strong parameters bypass. When called with a block, each_key returns an internal hash that does not respond to permitted?, enabling mass assignment to accept unpermitted parameters. This can allow a remote unauthenticated attacker to set unauthorized attributes, such as authorization flags. The issue affects versions prior to 8.0.5.2 and between 8.1.0.beta1 and 8.1.4.1. Fixed versions 8.0.5.2 and 8.1.4.1 correct the behavior to return the Parameters instance, which enforces permission checks.