PT-2020-21408

Name of the Vulnerable Software and Affected Versions datasette-indieauth versions prior to 1.1 Description A malicious user can sign in as a user with any IndieAuth identifier due to the implementation not verifying that the final "me" URL value returned by the authorization server belongs to th...