WS-2023-0258

Authorized clients in Tokenizer, having an injectprocessor secret, could brute-force the secret token value by abusing the fmt parameter to the Proxy-Tokenizer header...