Search results

Null byte in token endpoint parameters (code / client_id) triggers HTTP 500 instead of OAuth error response

Status: Open.

#2755 In simple-login/app;

· Allen-wick opened on Jun 11, 2026

Authorization code value echoed in token endpoint error messages

Status: Open.

#2754 In simple-login/app;

· Allen-wick opened on Jun 11, 2026

Token response includes non-standard "user" PII field (resolves existing TODO)

Status: Open.

#2753 In simple-login/app;

· Allen-wick opened on Jun 11, 2026

Fragile and non-RFC-compliant Bearer token parsing in UserInfo endpoint

Status: Open.

#2752 In simple-login/app;

· Allen-wick opened on Jun 11, 2026

Token endpoint accepts GET requests (RFC 6749 §3.2 violation)

Status: Open.

#2751 In simple-login/app;

· Allen-wick opened on Jun 11, 2026

State parameter not URL-encoded in authorization deny redirect (Parameter Injection risk)

Status: Open.

#2750 In simple-login/app;

· Allen-wick opened on Jun 11, 2026

OAuth scope parameter is not validated against client's allowed scopes

Status: Open.

#2749 In simple-login/app;

· Allen-wick opened on Jun 11, 2026

Fully open CORS (@cross_origin()) on sensitive OAuth endpoints

Status: Open.

#2748 In simple-login/app;

· Allen-wick opened on Jun 11, 2026

Undocumented /oauth/ attack surface (Double Blueprint Registration)

Status: Open.

#2747 In simple-login/app;

· Allen-wick opened on Jun 11, 2026

Dkim Selector value should be read from os environ. to facilitate changing the selector in simplelogin.env

Status: Open.

#2742 In simple-login/app;

· Wolf1098 opened on Jun 4, 2026

"Performing the extension setup..." frozen after login

Status: Open.

#2739 In simple-login/app;

· jkcbaqze opened on May 31, 2026

(Paid) account forwarding disabled with minimal warning

Status: Open.

#2733 In simple-login/app;

· cdman opened on May 25, 2026