Leaking internal headers in Flask Ninja with deserialization

There&rsquo;s an unfixed gadget living in Flask Ninja. Its HttpBearer authenticator reads the credential from a header named by a plain, writable attribute, so a deserialization sink that calls its result, or config that hydrates the auth object from untrusted data, is enough to repoint it at an internal header and leak it.