Product
The utcp-http library fails to validate the tokenUrl field in OpenAPI specifications, enabling an attacker to redirect OAuth2 credential submissions to arbitrary endpoints or perform SSRF attacks.