This has almost nothing to do with JWTs, or even OpenID Connect ... • Aaron Parecki

83°F

Jerry Gamblin https://twitter.com/JGamblin • May 30
Interesting JWT vulnerability. https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-apple/

This has almost nothing to do with JWTs, or even OpenID Connect for that matter.

Portland, Oregon • 58°F

Sun, May 31, 2020 11:06am -07:00

2 likes 4 replies
Have you written a response to this? Let me know the URL:
- Aaron Parecki twitter.com/aaronpk
  
  Posted a full writeup with a lot more details: aaronparecki.com/2020/05/31/30/…
  
  Sun, May 31, 2020 8:51pm +00:00 (via brid-gy.appspot.com)
- Aaron Parecki twitter.com/aaronpk
  
  lack of form validation
  
  Sun, May 31, 2020 6:12pm +00:00 (via brid-gy.appspot.com)
- Jerry Gamblin twitter.com/JGamblin
  
  Ok... what would you call it then?
  
  Sun, May 31, 2020 6:11pm +00:00 (via brid-gy.appspot.com)
- Aaron Parecki twitter.com/aaronpk
  
  I should have replied to that one. It’s barely a logic bug using JWT. I’m writing up more details in a blog post, will post a link shortly.
  
  Sun, May 31, 2020 6:11pm +00:00 (via brid-gy.appspot.com)

Posted in /replies using indigenous.abode.pub/ios