| Title | https://github.com/EchoHS/ GeekezBrowser 1.7.1 Local Sensitive Logic Exposure Leading to broswer track |
|---|
| Description | GeekEZ exposes two unauthenticated HTTP services on the local machine:
Public API: 127.0.0.1:<apiPort || 12138>
Internal Guard API: 127.0.0.1:12139
Both services return:
Access-Control-Allow-Origin: *
As a result, any web origin allowed to issue a localhost request can read the JSON responses. The responses contain GeekEZ-specific behavior and state:
/api/status reveals the number and IDs of currently running browser profiles.
/api/profiles reveals profile IDs, names, tags, and running status.
/api/runtime/language?profileId=... reveals runtime language and Accept-Language override state used by the anti-detect browser.
POST /api/profiles and PUT /api/profiles/:idOrName allow local profile configuration to be created or modified without authentication when the Public API is enabled.
|
|---|
| Source | ⚠️ https://github.com/EchoHS/GeekezBrowser/issues/60 |
|---|
| User | Anonymous User |
|---|
| Submission | 10/13/2026 15:25 (21 days ago) |
|---|
| Moderation | 11/02/2026 16:32 (20 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 429883 [EchoHS GeekezBrowser up to 1.7.2/1.8.0 Public API /api/status information disclosure] |
|---|
| Points | 20 |
|---|