CVE-2020-7787

CVE-2020-7787 affects all versions of react-adal. The root cause is in how nonce/session/refresh values are stored in browser storage: values are appended with ||, which means an empty string can be accepted in the validation, allowing an attacker-generated JWT to be treated as authentic. Affecte...