Redwood is vulnerable to account takeover via dbAuth "forgot-password

Description

This is an API vulnerability in Redwood’s [dbAuth], specifically the dbAuth forgot password feature:

• only projects with the dbAuth “forgot password” feature are affected
• this vulnerability was introduced in v0.38.0

Recommendation

Update the @redwoodjs/api package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 3.0.0, < 3.3.1

  >= 0.38.0, < 2.2.5**

• Patched version(s): **3.3.1

  2.2.5**

References

• GHSA-3qmc-2r76-4rqp

Related Issues

• Follow Redirects improperly handles URLs in the url.parse() function - CVE-2023-26159
• AngularJS allows attackers to bypass common image source restrictions - CVE-2024-8372
• Strapi Allows Unauthorized Access to Private Fields via parms.lookup - CVE-2024-56143
• Vite has an `server.fs.deny` bypass with an invalid `request-target` - CVE-2025-32395

Tags:

npm

@redwoodjs/api