1. OpenID Foundation Avatar OpenID Foundation
  2. WGs
  3. connect

Issues

Filter by:

Advanced search

Issues (1–21 of 21)

Title T P Status Votes Assignee Milestone Version Created Updated Actions
#2128: [Federation] The federation_trust_mark_endpoint requires a "sub" request parameter
Federation
bug critical resolved
#2100: Federation Historical Keys
Federation
bug critical resolved
#1777: VC Issuance is vulnerable to Unknown Key Share attacks
Credential Issuance
bug critical resolved
#1635: `credential_endpoint ` & `credential_issuer` should be removed from the service metadata
bug critical closed
#1194: Federation: Trust chain resolution: Require the signing JWK to be present in the superior statement's JWK set about the entity
Federation
bug critical closed
#1164: insecure front-channel use of private_key_jwt client authentication
Federation
bug critical closed
#1040: Security Issue - Attacker may reuse MS to register new clients
Federation
bug critical resolved
#920: Attack identified against self-issued "sub" values
Core
bug critical resolved
#595: Discovery 2 - No means of discovery without web server for domain
bug critical wontfix
#748: Messages 2.1.1.1 and 8.1 - MTI features for OpenID Request Object and Request File
Messages
bug critical resolved
#703: Key publication needs to be reworked (x509_url and jwk_url)
Messages
bug critical resolved
#513: Basic 1.2, Messages 8.14, Discovery 3.1, 3.2 - Issuer Identifier can not contain a path component
bug critical resolved
#546: Basic 2.1 & 2.1.2 - Claims requested by profile scope not defined
bug critical resolved
#522: All specs - Questioning the complexity of the Connect design
bug critical invalid
#463: Messages - xml2rfc syntax error
bug critical resolved
#331: Messages - How is id_token returned when not accompanied by a code or token?
bug critical duplicate
#310: Basic and maybe Messages and Standard - Several problems with statement about UserInfo response not guaranteed to be about the Subject in the session
bug critical resolved
#343: Messages - Why is a refresh token needed if an authentication code is being used?
bug critical resolved
#339: Messages, Standard - Meaning of login_required, session_selection_required and approval_required errors unclear
bug critical resolved
#88: Messages - Define how it should be Encrypted
bug critical resolved
#161: Standard - 7.1/7.2/7.2.1 - Check ID: Simply refer to messages 3.4.1/3.4.2/3.4.3
bug critical wontfix