Skip to content
OpenAdvisories

Package · PyPI

datasette-indieauth

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical —
    GHSA-mjcr-rqjg-rhg3

    Implementation trusts the "me" field returned by the authorization server without verifying it

    ### Impact A malicious user can sign in as a user with any IndieAuth identifier. This is because the implementation does not verify that the final `"me"` URL value returned by the authorization server belongs to the same domain as the initial value entered by…

    datasette-indieauth PyPI