CVE-2024-12056 Information

Description

The Client secret is not checked when using the OAuth Password grant type.

By exploiting this vulnerability an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment. Exploitation requires valid credentials and does not permit the attacker to bypass user privileges.

Reference

https://www.pcvue.com/security/security/#SB2024-4