If the oauth wall is managed by PHP, then it looks like the answer is yes, you’re vulnerable to client connections that haven’t logged in.
This looks like a bug in PHP’s assembly of multipart responses & you can feed one of those to the PHP backend with a simple web request, no auth required I think.
If you put the oauth wall in front of the application before it can even reach PHP (i.e. in your nginx/caddy/apache config), then no, assuming all paths are covered.
If the oauth wall is managed by PHP, then it looks like the answer is yes, you’re vulnerable to client connections that haven’t logged in.
This looks like a bug in PHP’s assembly of multipart responses & you can feed one of those to the PHP backend with a simple web request, no auth required I think.
If the backend can be reached, yes.
If you put the oauth wall in front of the application before it can even reach PHP (i.e. in your nginx/caddy/apache config), then no, assuming all paths are covered.
Probably yes
If anyone can login, probably yes. If only trusted people can, probably no.
Just remember that your LLM doesn't count as trusted people.