CVE-2026-31381: Use of GET Request Method With Sensitive Query Strings

An attacker can extract user email addresses PII exposed in base64 encoding via the state parameter in the OAuth callback URL...