The idp.session.consistentAddress property was botched. The conditional logic in the SessionManager doesn't bypass the address binding step, causing a CVE. In addition, the setting isn't used in other actions to bypass the address check, which would cause the address to be bound to the session there anyway.
The idp.session.consistentAddress property was botched. The conditional logic in the SessionManager doesn't bypass the address binding step, causing a CVE. In addition, the setting isn't used in other actions to bypass the address check, which would cause the address to be bound to the session there anyway.