CVE-2021-46249

Name of the Vulnerable Software and Affected Versions ScratchOAuth2 versions before commit d856dc704b2504cd3b92cf089fdd366dd40775d6

Description An authorization bypass issue exists due to a user-controlled key in the SpecificApps REST API. This allows app owners to set flags indicating whether an app is verified on their own apps. The issue is related to the SpecificApps REST API endpoint and a user-controlled key.

Recommendations For ScratchOAuth2 versions before commit d856dc704b2504cd3b92cf089fdd366dd40775d6, update to a version that includes the commit d856dc704b2504cd3b92cf089fdd366dd40775d6 to resolve the issue. As a temporary workaround, consider restricting access to the SpecificApps REST API to minimize the risk of exploitation.