org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment (aka Autobinding) vulnerability. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Java
Information Disclosure
Prototype Pollution
Connect
Mitreid
NVD
GitHub
CVSS 3.1
9.1
EPSS
2.2%