CVE-2026-80219

A flaw in hawtio-operator (OpenShift cluster mode) allows OAuth token theft. The operator creates a cluster-scoped OAuthClient with GrantMethod: auto and no client secret (public client). Because redirect URIs are derived from an operator-created Route whose hostname is tenant-controlled via the ...