| tiêu đề | crocodilestick Calibre-Web-Automated v1.0.0-v4.0.6 IDOR in auth-token generation leading to account takeover |
|---|
| Mô tả | An Insecure Direct Object Reference (IDOR) vulnerability in crocodilestick/Calibre-Web-Automated allows an authenticated user to impersonate any other user on the platform. The endpoint /kobo_auth/generate_auth_token/<int:user_id> does not validate if the requester has administrative privileges or matches the targeted user_id. An attacker can generate a long-lived auth token for a victim and use it against the /kobo/<auth_token>/v1/initialization route. user_id is an integer that increments from 1, so it is easy to guess the administrator's user_id. Because the application calls login_user(user) based on the token owner within the requires_kobo_auth decorator, this leads to a complete session takeover and persistent impersonation of the victim. |
|---|
| Nguồn | ⚠️ https://gist.github.com/menelausx/ef98aa78ed2869ccaa316ff45ed1a440 |
|---|
| Người dùng | JasperX (UID 97281) |
|---|
| Đệ trình | 16/04/2026 08:52 (cách đây 6 các tháng) |
|---|
| Kiểm duyệt | 03/05/2026 09:59 (17 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 360889 [crocodilestick Calibre-Web-Automated đến 4.0.6 Kobo auth-token Route cps/kobo_auth.py generate_auth_token nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|