Ditto Explorer Ui
Monthly
Account takeover of Eclipse Ditto Explorer users is possible via a crafted link that injects an attacker-controlled OIDC authority or API URI when the autoSso feature is enabled (versions 3.6.0 through 3.9.7). The victim's OAuth authorization code and PKCE verifier are redirected to the attacker's token endpoint, enabling redemption for access and refresh tokens; alternatively, bearer tokens or Basic credentials are leaked to an attacker-controlled api_uri. Exploitation requires unauthenticated remote attackers to convince a victim to click the link and authenticate, but the configuration persists, causing repeated token theft on subsequent visits; no public exploit code has been identified at time of analysis, and the independent assessment deems this a credible but conditional account-takeover flaw rather than a mass-exploitation emergency.
Account takeover of Eclipse Ditto Explorer users is possible via a crafted link that injects an attacker-controlled OIDC authority or API URI when the autoSso feature is enabled (versions 3.6.0 through 3.9.7). The victim's OAuth authorization code and PKCE verifier are redirected to the attacker's token endpoint, enabling redemption for access and refresh tokens; alternatively, bearer tokens or Basic credentials are leaked to an attacker-controlled api_uri. Exploitation requires unauthenticated remote attackers to convince a victim to click the link and authenticate, but the configuration persists, causing repeated token theft on subsequent visits; no public exploit code has been identified at time of analysis, and the independent assessment deems this a credible but conditional account-takeover flaw rather than a mass-exploitation emergency.