1 result · Feed
-
Unscored —
Rejected authentication challenges can poison the Key Vault scope cache
Affected versions of `KeyVaultAuthorizer::on_challenge` cache the authentication scope from a `WWW-Authenticate` response before verifying that the challenge resource matches the requested endpoint. When verification rejects the challenge, the scope remains c…