[rwth-security] When PKCE Cannot Protect Your Confidential OAuth Client