PKCE Downgrade Attack: When the Authorization Server Accepts Both Flows

Two CVEs against the same identity provider, filed six months apart. CVE-2023-48228 and...