Authorization Bypass

datasetteindieauth is vulnerable to authorization bypass. The vulnerability exists because it does not check that the final me URL value returned by the authorization server belongs to the same domain as the initial value entered by the user, allowing an attacker to sign in using any IndieAuth...