Grayom

An authentication bypass exists that allows unauthenticated attackers to forge sign-in links by utilizing the publicly known example `AUTH SECRET`. This flaw enables attackers to enumerate registered emails via the '/api/ auth/signin' endpoint, forge HS256 JWTs (JSON Web Tokens, which are open standards for securely transmitting information between parties as a JSON object) redeemed by the '/api/ auth/continue' endpoint, impersonate users, export analytics data, and transfer app ownership.

Unauthenticated attackers can execute arbitrary SQL by providing a crafted task group key to the orchestrator API. By sending a malicious `group.key` to the 'POST /v1/immediate' endpoint, the `TaskEventsHandler.notify()` function interpolates the input into a Postgres NOTIFY statement, enabling the execution of stacked queries against the scheduler database.

An authorization flaw exists in the `checkPermissionsForCreateOrUpdate()` function within the `Multitenancy` class. In licensed multi-tenant deployments where multiple applications share a non-default connection URI domain and use separate `api keys`, an attacker with a valid API key for one application can update the parent connection URI domain. This occurs because the system fails to require the source application and tenant to be public when checking the domain during create or update operations. Consequently, an attacker can replace the parent key and sibling application keys, modify sibling users, hijack sessions, and establish persistence via sibling dashboard users. Additionally, omitting the optional identifier in v2 create or update handlers allows an attacker to target the base tenant, bypassing permission checks and enterprise-feature gates to modify `firstFactors`, required secondary factors, and recipe-enabled flags, which compromises login integrity and availability.

An issue exists in the `SAML.handleCallback()` function where it fails to consume RelayState, record assertion identifiers, or enforce `Response.InResponseTo`. In Service Provider (SP)-initiated flows, an attacker with a valid SAML response and matching RelayState can resubmit them to the `/recipe/saml/callback` endpoint before the assertion expires. In Identity Provider (IdP)-initiated flows, assertions can be replayed without RelayState. Additionally, the lack of `Response.InResponseTo` checks allows an active login to be completed using an assertion for a different identity and bypasses the `allowIDPInitiatedLogin=false` setting. The callback also fails to validate Destination or SubjectConfirmationData Recipient and NotOnOrAfter, resulting in the creation of a new authorization code for the captured user's identity.

An authorization bypass allows authenticated agent bots to access other accounts by providing a foreign contact inbox `source id`. This is achieved by calling the 'conversations create' endpoint with a `source id` belonging to another account, enabling the creation or retrieval of conversations and the posting of messages to that account's contacts.