Redwood is vulnerable to account takeover via dbAuth "forgot-password

Description

This is an API vulnerability in Redwood’s [dbAuth], specifically the dbAuth forgot password feature:

• only projects with the dbAuth “forgot password” feature are affected
• this vulnerability was introduced in v0.38.0

Recommendation

Update the @redwoodjs/api package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 3.0.0, < 3.3.1

  >= 0.38.0, < 2.2.5**

• Patched version(s): **3.3.1

  2.2.5**

References

• GHSA-3qmc-2r76-4rqp

Related Issues

• Vite has an `server.fs.deny` bypass with an invalid `request-target` - CVE-2025-32395
• Marp Core allows XSS by improper neutralization of HTML sanitization - CVE-2024-56510
• bootstrap Cross-site Scripting vulnerability (GHSA-ph58-4vrj-w6hr) 2 - CVE-2018-20677
• Bootstrap Cross-site Scripting vulnerability (GHSA-7mvr-5x2g-wfc8) 2 - CVE-2018-14042

Tags:

npm

@redwoodjs/api