GHSA-qx82-28gf-w744: 
JavaScript vulnerability analysis and mitigation

Summary

The OAuth provider clientSecretEnv setting is not restricted to OAuth secrets, and provider URLs are fetched without scheme or destination checks. A holder of admin:write can use provider configuration to obtain secrets the server process holds (signing keys, service token, database credentials) and to make the server send requests to internal addresses. A non-https authorizationUrl is also accepted and followed by the React client.

Affected code

• src/services/oauthService.ts (token exchange, userinfo, JWKS fetches)
• @seamless-auth/types system config schema (clientSecretEnv, provider URL fields)
• @seamless-auth/client OAuth redirect

Fix plan (0.19.4)

• Allow only a reserved secret name pattern for clientSecretEnv and refuse names the server itself reads
• Require https provider URLs, refuse private, loopback and link-local destinations, do not follow redirects
• Refuse non-https authorizationUrl; client-side scheme check follows as public hardening after publication Requires admin:write. Step-up on config writes is tracked in #437.