In JetBrains Ktor prior to 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly.
jetbrains ktor