Dastaj

**Name of the Vulnerable Software and Affected Versions** Lobe Chat versions prior to 0.122.4 **Description** The issue allows access to plugins without proper authorization when the application is password-protected and deployed with the `ACCESS CODE` option. This means that even though the application requires a password to access the chat, plugins can still be interacted with without entering the password. For example, an HTTP request to the "/api/plugin/gateway" endpoint can be made without providing the `ACCESS CODE`, allowing unauthorized access to plugins. **Recommendations** For versions prior to 0.122.4, update to version 0.122.4 or later to resolve the issue. As a temporary workaround, consider verifying the `ACCESS CODE` for HTTP requests to the `/api/plugin/` route to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** next-auth versions prior to 4.24.5 **Description** A vulnerability in next-auth allows a bad actor to create an empty/mock user by obtaining a NextAuth.js-issued JWT from an interrupted OAuth sign-in flow and manually overriding the `next-auth.session-token` cookie value. This mock user has no information associated with it, but can be used to simulate a logged-in user and potentially peek at logged-in user states, such as dashboard layouts. The vulnerability does not give access to other users' data or resources that require proper authorization. **Recommendations** For versions prior to 4.24.5, upgrade to version 4.24.5 or later by running `npm i next-auth@latest`, `yarn add next-auth@latest`, or `pnpm add next-auth@latest`. As a temporary workaround, developers can use a custom authorization callback for Middleware to manually perform basic authentication, such as checking the existence of a property like `email` on the `token` object.