Mfazrinizar

**Name of the Vulnerable Software and Affected Versions** morgan versions prior to 1.12.0 **Description** An issue exists in the internal helper used to escape log token values. The software fails to neutralize Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can inject these characters into an attacker-controlled log token, such as a Basic auth username processed via the `remote-user` token. This allows for log forging, where Unicode-aware downstream log processing systems split a single request log into multiple logical records. **Recommendations** Upgrade to version 1.12.0.