Redwood is vulnerable to account takeover via dbAuth "forgot-password

Description

This is an API vulnerability in Redwood’s [dbAuth], specifically the dbAuth forgot password feature:

• only projects with the dbAuth “forgot password” feature are affected
• this vulnerability was introduced in v0.38.0

Recommendation

Update the @redwoodjs/api package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 3.0.0, < 3.3.1

  >= 0.38.0, < 2.2.5**

• Patched version(s): **3.3.1

  2.2.5**

References

• GHSA-3qmc-2r76-4rqp

Related Issues

• a12nserver vulnerable to potential SQL Injections via Knex dependency - Vulnerability
• @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details - CVE-2022-39350
• Strapi may leak sensitive user information, user reset password, tokens via content-manager views - CVE-2023-36472
• Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint - CVE-2023-46729

Tags:

npm

@redwoodjs/api