Vendor
The Kroxylicious Azure Key Vault KMS provider fails to validate vaultName parameters during EDEK wire-deserialization, enabling SSRF attacks to exfiltrate Azure bearer tokens.