Vendor
The Omnivore API improperly validates Apple sign-in tokens, allowing attackers to perform algorithm confusion attacks to bypass authentication and impersonate users.