Information Disclosure

oak-core is vulnerable to information disclosure. The optional initial password change and password expiration features causes the new password to be disclosed due to the credentials object being retained and not removed upon a successful password change...

Timing Attack

Oak Core is vulnerable to timing attacks. Different responses are given for existing and non-existing user names from the server, allowing attackers to focus on guessing passwords for existing accounts...