Replay Attack

Spring Security is vulnerable to Replay Attack. The vulnerability is due to a strict size limit on the cache storing JWT ID claims, which allows an attacker to evict legitimate entries by flooding the server with dummy requests and subsequently replay intercepted valid DPoP proofs...

WS-2021-0046

A verification flaw in the implementation of the identity token verifier library https://github.com/solid/identity-token-verifier allows DPoP proofs to be spoofed. DPoP proofs are used to bind access tokens to a private key meant to be in sole possession of a specific user. Instead of verifying...

Verification flaw in Solid identity-token-verifier

Impact Severity Any Pod on a Solid server using a vulnerable version of the identity-token-verifier library is at risk of a spoofed Demonstration of Proof-of-Possession DPoP token binding. This vulnerability could give total and complete access to a targeted Pod. Summary A verification flaw in th...