Threats tagged 'ghsa-x27r-mfxr-pcpj'

A vulnerability in affected versions of Octopus Server allows a user with permission to edit accounts to exploit insufficient validation of custom claims on OIDC accounts. This flaw enables the issuance of signed OIDC tokens that impersonate a different project, potentially granting unauthorized access to external systems that trust the impersonated project's identity.