3 ms·
agreed… why can an ID token for a separate client application be used to read and write to GitHub? that’s the story here.
by carstonh 10d ago
agreed… why can an ID token for a separate client application be used to read and write to GitHub? that’s the story here.
- jsiepkes 10d agoNot checking the "audience" of a token or misconfiguring it is pretty common. A lot of applications don't actually check it.
- 6thbit 9d agosince it was sso for their codex/chatgpt account, presumably they used an existing chatgpt github connector available to such accounts. Somehow the auth'd token for the forum was available within that VM, so having RCE they could've replayed it? idk