Search results

[Security] low: Account-lockout failure counter uses non-atomic read-modify-write (race allows extra guesses)

securitySecurity vulnerabilitySecurity vulnerability

severity:low

Status: Open.

#324 In VilnaCRM-Org/user-service;

· dmytrocraft opened on Jun 9, 2026

[Security] medium: Raw OAuth provider exception messages leaked to unauthenticated clients

backend

phpPull requests that update Php codePull requests that update Php code

securitySecurity vulnerabilitySecurity vulnerability

severity:medium

Status: Open.

#323 In VilnaCRM-Org/user-service;

· dmytrocraft opened on Jun 9, 2026

[Security] medium: Recovery-code verification falls back to unsalted SHA-256 (offline brute-force on DB leak)

securitySecurity vulnerabilitySecurity vulnerability

severity:medium

Status: Open.

#322 In VilnaCRM-Org/user-service;

· dmytrocraft opened on Jun 9, 2026

[Security] medium: Password-reset request endpoint: user-enumeration timing oracle and weak rate-limiting/normalization

backend

phpPull requests that update Php codePull requests that update Php code

securitySecurity vulnerabilitySecurity vulnerability

severity:medium

Status: Open.

#321 In VilnaCRM-Org/user-service;

· dmytrocraft opened on Jun 9, 2026

[Security] medium: Broken object-level authorization: any authenticated user can read and enumerate all users' PII

securitySecurity vulnerabilitySecurity vulnerability

severity:medium

Status: Open.

#320 In VilnaCRM-Org/user-service;

· dmytrocraft opened on Jun 9, 2026

[Security] high: Production image ships dev-only CORS origin regex with Access-Control-Allow-Credentials: true

securitySecurity vulnerabilitySecurity vulnerability

severity:high

Status: Open.

#319 In VilnaCRM-Org/user-service;

· dmytrocraft opened on Jun 9, 2026

[Security] high: Facebook OAuth account takeover via forged emailVerified=true auto-link

backend

phpPull requests that update Php codePull requests that update Php code

securitySecurity vulnerabilitySecurity vulnerability

severity:high

Status: Open.

#318 In VilnaCRM-Org/user-service;

· dmytrocraft opened on Jun 9, 2026

[Security] high: Schemathesis cleanup listener can delete users by request-body email in production

securitySecurity vulnerabilitySecurity vulnerability

severity:high

Status: Open.

#317 In VilnaCRM-Org/user-service;

· dmytrocraft opened on Jun 9, 2026

[Security] high: Rate limiters key on untrusted client IP (no trusted_proxies), collapsing anti-automation onto the load-balancer IP

securitySecurity vulnerabilitySecurity vulnerability

severity:high

Status: Open.

#316 In VilnaCRM-Org/user-service;

· dmytrocraft opened on Jun 9, 2026

[Security] high: GraphQL endpoint bypasses all per-endpoint rate limiters (sign-in, refresh, password-reset, 2FA)

securitySecurity vulnerabilitySecurity vulnerability

severity:high

Status: Open.

#315 In VilnaCRM-Org/user-service;

· dmytrocraft opened on Jun 9, 2026

[Security] high: Two-factor (2FA/TOTP) verification: no server-side brute-force counter and codes are replayable

backend

phpPull requests that update Php codePull requests that update Php code

securitySecurity vulnerabilitySecurity vulnerability

severity:high

Status: Open.

#314 In VilnaCRM-Org/user-service;

· dmytrocraft opened on Jun 9, 2026

[Security] high: Password-reset and email-confirmation tokens stored in plaintext at rest

backend

phpPull requests that update Php codePull requests that update Php code

securitySecurity vulnerabilitySecurity vulnerability

severity:high

Status: Open.

#313 In VilnaCRM-Org/user-service;

· dmytrocraft opened on Jun 9, 2026