CVE-2020-5497

The CVE-2020-5497 issue affects the MITREid Connect OpenID Connect reference implementation (OpenID-Connect-Java-Spring-Server) up to version 1.3.3. The root cause is that userInfoJson is included in the page unsanitized (related to header.tag), which enables cross-site scripting and can allow ar...

CVE-2021-26715

The CVE-2021-26715 issue affects MITREid Connect OpenID Connect server (up to 1.3.3). The vulnerability is a Server-Side Request Forgery (SSRF) caused by unsafe handling of the logo_uri parameter in Dynamic Client Registration. An unauthenticated attacker can force the vulnerable server to make H...

CVE-2021-27582

MITREid Connect OpenID Connect server (MITREid Connect) before 1.3.3 is affected by a Mass Assignment (Autobinding) vulnerability in OAuthConfirmationController.java. The issue arises from unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, allowing HTTP request pa...