Apicast proxies the api call with incorrect jwt token to the api backend without proper authorization check

CVE-2023-0456

Summary

A flaw in the APICast OIDC module fails to properly handle responses from mismatched tokens originating from different realms. This oversight can potentially allow attackers to gain unauthorized access to sensitive information, as it might open doors to realms that should remain secure. Timely patching and updates are essential to safeguard against such vulnerabilities.

References