CVE-2018-8899

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might...

Original description

The description as published by the source.

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

advisory github.com
advisory github.com
patch github.com
report github.com