3 ms·
It’s unclear to me exactly where the vulnerability is given the authors description in “technical details”. Does this occur in the implicit flow as well as the
by catlifeonmars 6y ago
It’s unclear to me exactly where the vulnerability is given the authors description in “technical details”. Does this occur in the implicit flow as well as the code flow? Is the token request unauthenticated? This seems highly unlikely. Or does Sign In With Apple deviate from the Open ID specification in a way that I’m unfamiliar with?
- gouggoug 6y agoThe author found out that the HTTP endpoint used to generate a JWT token would accept any email and respond with a valid JWT token for that email address. He could literally send a POST request to that endpoint with arbitrary email addresses and get a valid JWT. This is clearly explained under the "BUG" section.
- catlifeonmars 6y agoThat part I understand. It’s unclear to me in which auth endpoint(s) and auth flow(s) are affected. Is it the token endpoint, or auth endpoint? Or is it somewhere in the login flow before the user agent is redirected to the token endpoint?