Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Auth...

Summary

Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resource_metadata="..."...

References

• web 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
• web 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
• web 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
• web 6b3ad84c-e1a6-4bf7-a703-f496b71e49db