Eric Smith

A flaw exists in the OpenID Connect / OAuth client module that allows for privilege escalation due to improper handling of case sensitivity. The module does not adequately validate the uniqueness of user fields, potentially allowing a user to register with an email address already associated with another account. This can lead to data integrity issues when a user signs in for the first time.

A Cross-Site Request Forgery (CSRF) issue affects the Configuration Split module, allowing unauthorized actions to be performed. This issue may be exploited to perform actions on behalf of another user without their knowledge or consent.

The issue allows remote authenticated users to cause a denial of service by sending a large number of spoofed ARP packets to the management interface, which creates a large ARP table and exhausts memory.