QIWI: disclosing clients' secret keys https://stage-uapi.tochka.com:2000/

The reporter has found an open URL on a staging server leaking client IDs and client secrets used in oauth2...

Security Bulletin: IBM Verify Gateway does not hide client secrets when debug tracing is active (CVE-2020-4372)

Summary When the IBM Verify Gateway IVG components are run with debug tracing, client secrets such as the username, password, and client-id are included in the debug log. As of v1.0.1 of IVG for RADIUS and IVG for AIX PAM, and v1.0.2 of IVG for Linux PAM and IVG for Windows Login, these client...

PT-2021-11425 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak versions prior to 13.0.0 Description: A flaw was found in the client registration endpoint, allowing it to fetch information about PUBLIC clients, such as client secrets, without authentication. This could be an issue if the same...

Information Disclosure

github.com/ory/fosite is vulnerable to information disclosure. The vulnerability exists as the request body may contain client secrets to be exposed when POST-body based client authentication is enabled...