AIKIDO-2025-10627

TL;DR

Affected versions of this package are vulnerable to OpenID Connect Issuer Validation Bypass due to a missing validation of the issuer field in the discovered OpenID Configuration document against the expected authority URL. An attacker could exploit this by poisoning a reverse proxy cache or via a man-in-the-middle attack to redirect discovery requests to a malicious domain, which would then supply a fraudulent configuration document with a matching issuer.