Finderer

**Name of the Vulnerable Software and Affected Versions** Tugtainer versions prior to 1.30.3 **Description** OIDC authentication can be initiated even when the `OIDC ENABLED` variable is set to false. While the '/auth/oidc/enabled' endpoint correctly reports that the feature is disabled, a direct request to the '/auth/oidc/login' endpoint still triggers the OIDC login flow. This process returns an HTTP 302 response, sets an `oidc state` cookie, and redirects the user to the configured OIDC authorization endpoint, effectively bypassing the intended disable switch. **Recommendations** Update to version 1.30.3.

**Name of the Vulnerable Software and Affected Versions** Tugtainer versions prior to 1.30.4 **Description** Tugtainer Agent allows unauthenticated access to Docker management APIs when the `AGENT SECRET` is not configured. The system uses request signatures to protect API routes, but the signature verification function in `agent/auth.py` returns successfully if `Config.AGENT SECRET` is empty, bypassing authentication for protected Agent APIs. **Recommendations** Update to version 1.30.4. Configure the `AGENT SECRET` variable to ensure API routes are protected by signature verification.

**Name of the Vulnerable Software and Affected Versions** Tugtainer versions prior to 1.30.6 **Description** An authenticated user can trigger the backend server to send outbound HTTP requests to arbitrary user-supplied URLs. This occurs via the '/settings/test notification' endpoint, which accepts a `urls` field and passes it to Apprise without restricting protocols, hostnames, localhost addresses, private IP ranges, or cloud metadata addresses. This flaw enables an authenticated blind server-side request forgery (SSRF), a condition where an attacker induces the server to make requests to an unintended location. **Recommendations** Update to version 1.30.6.

**Name of the Vulnerable Software and Affected Versions** Bluehood versions prior to 0.7.1 **Description** When `auth enabled` is active, session validation is only enforced on HTML page handlers. The `/api/*` endpoints, including `/api/device/{mac}/notes`, do not perform authentication checks. A network attacker with access to the dashboard port can read Bluetooth tracking data and modify application state, such as the heartbeat URL, prune retention, device groups, and per-device notes, without requiring a session cookie. **Recommendations** Update to version 0.7.1.