Bytejmp

A race condition exists in the `oauth-token.service.ts` file. This issue occurs during non-atomic rotation, allowing an attacker who has captured a refresh token to present it concurrently with the legitimate client. By doing so, the attacker can obtain their own access and refresh tokens, maintaining scoped access to the system without triggering the reuse detection mechanism.

An information disclosure issue exists where unauthenticated attackers can retrieve full OAuth client records. This is achieved by querying the public client lookup route in `oauth.controller.ts`. Attackers who possess or guess a client identifier can obtain the registration access token, the bcrypt client secret hash, and the owner's internal identifier, potentially allowing them to modify or delete registrations.

Improper access controls exist within the Snapshot Model component. This issue allows remote exploitation via the `/api/v1/snapshots` endpoint, specifically affecting the `SnapshotPolicy.viewAny()` and `SnapshotPolicy.view()` functions.

A path traversal issue exists in the database-servers API endpoint within the file `app/Http/Requests/Api/V1/RestoreRequest.php`. A remote attacker can exploit this by manipulating the `schema name` argument. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly neutralized.

A path traversal flaw exists in the Public Journey Photo Proxy component within the file `server/src/nest/journey/journey-public.controller.ts`. This issue allows a remote attacker to perform a manipulation that results in unauthorized access to files and directories. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths.

An issue exists in the Journey Photo Proxy component where the `validateShareTokenForAsset()` function can be manipulated. This flaw allows a remote attacker to achieve incorrect authorization, although the attack is characterized by high complexity and is difficult to exploit.

Remote manipulation of the `loginUser()` function within the `server/src/services/authService.ts` file of the Pre-2FA mfa token Handler component leads to improper authentication.

An issue in the Journey Entry Update component allows for remote SQL injection. This occurs within the `journeyService.updateEntry()` function located in the server/src/nest/journey/journey.controller.t file. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

An issue in the OIDC Service component within the `findOrCreateUser()` function of the `server/src/services/oidcService.ts` file allows for improper authentication. This flaw can be exploited remotely, although the attack requires a high level of complexity and is considered difficult to execute.