An issue allows unauthenticated attackers to induce the server to send HTTP requests by registering an OAuth2 client with an unvalidated `jwks uri`. This can be triggered via the token introspection endpoint using an unsigned `client assertion`, enabling the probing of internal services and access to cloud metadata endpoints. Server-side request forgery is a flaw where a server is tricked into making requests to an unintended location.