A newly disclosed flaw in the Assent library's "Sign in with Apple" strategy lets an unauthenticated attacker impersonate another user during the OAuth callback. The bug stems from the callback handler trusting a client-supplied name field and merging it into the verified user data without properly separating trusted and untrusted input. Any application relying on this strategy for Apple sign-in should check for a patched release.
// source: nvd.nist.gov ↗