Yeah. I've been ranting about a similar thing in the context of jsonwebtoken to our security guy some days ago. The vulnerability pretty much goes "Well if I ca

Yeah. I've been ranting about a similar thing in the context of jsonwebtoken to our security guy some days ago. The vulnerability pretty much goes "Well if I can inject an object with a toString() method of my choosing into your running program, then you're totally vulnerable". Yeah, if you can inject and execute code.. you have achieved RCE? Kind of the whole pickle-discussion from python. And nontheless, the assumed precondition for the vulnerability allows you to poison the key used to verify web tokens, so if you can inject data there, very big things immediately explode, like the entire authentication of the system collapsing. But anyway, it's going round as a 7.6 with "trivial exploitation" in "JWTs" and OIDC uses those... and now I have scared developers, and POs and customers calling and so on. This makes it quite challenging and honestly somewhat exhausting to attempt to define a somewhat straightforward security process which doesn't cause alert fatigue very quickly.