| Package | Affected versions | Patched versions |
|---|---|---|
| identityserver4 | ≥ 1.0.0, ≤ 1.5.2≥ 2.0.0, ≤ 2.1.2 |
IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free