Insecure Redirect Validation

github.com/ory/fosite suffers from insecure redirect validation. The vulnerability exists due to the usage of strings.ToLower while they should have been compared with a simple string match...

Insecure Session Management

github.com/ory/fosite uses insecure session management. The vulnerability exists as it fails to validate the uniqueness of this jti value in privatekeyjwt client authentication method, allowing an attacker to send the same token request twice with the same jti assertion to get two access tokens...

Information Disclosure

github.com/ory/fosite is vulnerable to information disclosure. The vulnerability exists as the request body may contain client secrets to be exposed when POST-body based client authentication is enabled...