Symptoms

Using the wrong syntax in the login request payload reflects the whole request payload in the response, which may contain the original password from the request in clear text.

Impact

Request Password is shown in cleartext

Conditions

Using "loginReference" instead of "loginProviderName" in the login request

Workaround

None

Fix Information

None

Behavior Change