Progress Report on Handling an Actionable Security Vulnerability

I gave a presentation at the 2026 OAuth Security Workshop in Leipzig describing the actions we took when an actionable security vulnerability was discovered affecting numerous OpenID and OAuth specifications. Much of the information discussed was not previously public. As I described when writing about a spec we created to address the problems, the security […]