low2.3
CVE-2024-12056
The Client secret is not checked when using the OAuth Password grant type.
Impact
The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment. Exploitation requires valid credentials and does not permit the attacker to bypass user privileges.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.