Zero-day in Sign in with Apple bhavukjain.com/blog/2020/05/…
6
8
2
28
if I understand correctly, the token request accepted an alternative email claim value and used it to override the value on Apple’s IDP. Really?
2
1
1
Replying to @tlodderstedt @leastprivilege
If I'm reading it right it's not the token endpoint, it's their internal API for accepting the request that let the user choose which email to share with the app. So it's a form validation problem.

May 31, 2020 · 12:37 PM UTC

1
Replying to @aaronpk @leastprivilege
But it’s exposed to the client and did accept arbitrary values, right?
2
Yea, it's just not part of the OAuth API. It's more like bad logic on the internal implementation of the AS.
2
1
more replies