CVE-2026-80219 Hawtio-operator: hawtio-operator: oauthclient created with grantmethod auto and no secret enables oauth token theft

A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval GrantMethod: auto and no client secret public client. The redirect URIs are derived from the operator-created Route, whose hostname is...