-
Notifications
You must be signed in to change notification settings - Fork 2
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
[Security] high: Poisoned Pipeline Execution in graphql-diff.yml leaks org-wide GitHub App token persisted to .git/config
securitySecurity vulnerabilitySecurity vulnerabilityStatus: Open.#478 In VilnaCRM-Org/user-service;[Security] medium: Email-verification bypass: confirmation token is bound to userID, not the email being confirmed, letting an attacker confirm an email address they do not control
phpPull requests that update Php codePull requests that update Php codesecuritySecurity vulnerabilitySecurity vulnerabilityStatus: Open.#477 In VilnaCRM-Org/user-service;[Security] medium: Account lockout is weaponizable as a persistent, self-sustaining availability DoS against arbitrary users (no per-source scoping, lock TTL refreshed on every failure, victim cannot self-recover)
phpPull requests that update Php codePull requests that update Php codesecuritySecurity vulnerabilitySecurity vulnerabilityStatus: Open.#476 In VilnaCRM-Org/user-service;[Security] low: GraphQL field-suggestion ("Did you mean") schema disclosure despite introspection disabled in prod
phpPull requests that update Php codePull requests that update Php codesecuritySecurity vulnerabilitySecurity vulnerabilityStatus: Open.#475 In VilnaCRM-Org/user-service;[Security] high: Refresh-token grace window forks an independent, undetected parallel token chain (rotation reuse-detection bypass)
phpPull requests that update Php codePull requests that update Php codesecuritySecurity vulnerabilitySecurity vulnerabilityStatus: Open.#474 In VilnaCRM-Org/user-service;[Security] medium: Email-confirmation tokens still stored in cleartext in Redis (incomplete remediation of #313; only password-reset half was hashed)
phpPull requests that update Php codePull requests that update Php codesecuritySecurity vulnerabilitySecurity vulnerabilityStatus: Open.#473 In VilnaCRM-Org/user-service;[Security] high: OAuth2 password grant bypasses account lockout AND mandatory 2FA enforcement (parallel auth path missing controls)
phpPull requests that update Php codePull requests that update Php codesecuritySecurity vulnerabilitySecurity vulnerabilityStatus: Open.#472 In VilnaCRM-Org/user-service;[Security] low: Raw user email addresses (PII) written to production logs in cleartext at INFO level, with no scrubbing and prod log level=debug
phpPull requests that update Php codePull requests that update Php codesecuritySecurity vulnerabilitySecurity vulnerabilityStatus: Open.#471 In VilnaCRM-Org/user-service;[Security] medium: Abuse-prevention GraphQL mutations (createUser, requestPasswordResetUser, confirmUser) have no per-endpoint rate limiter, enabling email bombing / mass registration via /api/graphql
phpPull requests that update Php codePull requests that update Php codesecuritySecurity vulnerabilitySecurity vulnerabilityStatus: Open.#470 In VilnaCRM-Org/user-service;[Security] high: GraphQL per-endpoint rate limiters silently bypassed: resolver matches short operation names (signIn) but real schema fields are suffixed (signInUser)
phpPull requests that update Php codePull requests that update Php codesecuritySecurity vulnerabilitySecurity vulnerabilityStatus: Open.#469 In VilnaCRM-Org/user-service;[Security] medium: Account pre-hijacking via OAuth email auto-link (attacker pre-registers victim's email, then victim's social login links to and confirms the attacker's account)
phpPull requests that update Php codePull requests that update Php codesecuritySecurity vulnerabilitySecurity vulnerabilityStatus: Open.#468 In VilnaCRM-Org/user-service;[Security] medium: Third-party GitHub Actions pinned to mutable tags (not commit SHAs) in secret- and signing-privileged workflows
securitySecurity vulnerabilitySecurity vulnerabilityStatus: Open.#467 In VilnaCRM-Org/user-service;