-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key functions: 1) redirect_to_auth_server stored user-provided destination in OAuth state without signing/validation, and 2) oidc_callback used this untrusted destination for redirection. The fix introduced cryptographic signing (destination_serializer) in redirect_to_auth_server and validation in oidc_callback, confirming these were the vulnerable points. The pre-patch code's 'TODO' comment and direct redirect() call with raw destination parameter demonstrate the lack of validation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| flask-oidc | pip | < 1.0.0 | 1.0.0 |