Jamesbishup

An issue exists during self-registration where the system fails to enforce the Valid Creation Attributes list. This allows anonymous attackers to set restricted attributes, such as group membership, by using the legacy self-service REST endpoint or the User Self-Service flow. By manipulating these attributes, an attacker can join administrative groups and obtain full administrative control of the system.

A server-side request forgery (SSRF) issue exists where attackers with permissions to register or modify OAuth 2.0 clients can force the server to fetch internal resources. This occurs through the use of an unvalidated `jwks uri` variable. By leveraging client-authentication and ID-token validation, unauthenticated fetches can be triggered to probe internal hosts, metadata endpoints, or local files, or to cause a denial of service by exhausting request threads.