Client secret checks are vulnerable to timing attacks, which could permit an attacker to determine client secrets.
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2022-1201" }
{ "imports": [ { "path": "github.com/openshift/osin", "symbols": [ "CheckClientSecret", "DefaultClient.ClientSecretMatches", "Server.HandleAccessRequest", "Server.HandleAuthorizeRequest" ] } ] }