WS-2023-0113

A hop-by-hop abuse was found in oathkeeper. Downstream services relying on the presence of headers set by the header mutator could be exploited. A client can drop the header set by the header mutator by including that header's name in the Connection header. The X-Subject header will not arrive at...