Authentication Bypass in console-io

Description

Affected versions of the console-io package do not configure the underlying websocket library to require authentication, resulting in an authentication bypass vulnerability. As console-io allows terminal access on the server via a web page, an authentication bypass is essentially remote code execution.

Recommendation

Update the console-io package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.3.0
• Patched version(s): 2.3.0

References

• GHSA-q52j-4q2q-hcj6
• www.npmjs.com
• CVE-2016-10532
• CWE-287
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• Authentication Bypass in hapi-auth-jwt2 - CVE-2016-10525
• Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters - CVE-2026-30863
• Authentication bypass vulnerability in Apple Game Center auth adapter - CVE-2022-31083
• Sanitization bypass using HTML Entities in marked - CVE-2016-10531

Tags:

npm

console-io