CVE-2021-28290: XSS issue in Client Secrets and Api Resource Secrets · Issue #813 · skoruba/IdentityServer4.Admin

In the views ClientSecret and ApiResourceSecret is not HTML encoded data attribute data-secret-value on the button:

<td><button class="secret-value-button btn btn-outline-primary" data-secret-value="clientSecret.Value"><i class="fa fa-eye"></i></button></td>

This data attribute is used in the dialog with secret detail.

<button class="secret-value-button btn btn-outline-primary" data-secret-value="@Html.Encode(clientSecret.Value)"><i class="fa fa-eye"></i></button>

I will send this fix asap.

Thanks to Silton Santos for reporting.