Skip to content
OpenAdvisories

Package · crates.io

kanidm

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.7
    GHSA-53hj-r94p-8c8f

    Kanidm has non-constant-time comparison of OAuth2 client_secret

    ### Summary The kanidmd OAuth2 token-exchange (`/oauth2/token`) and token-introspection (`/oauth2/token/introspect`) endpoints compare the supplied `client_secret` against the stored secret using Rust's `PartialEq` on `String`, which short-circuits on the fir…

    kanidm crates.io