Har1Sh-K

The Asana Trigger lacks proper authentication, allowing it to accept a new webhook verification secret from any request that includes an `X-Hook-Secret` header. An unauthenticated attacker with knowledge of the webhook URL can replace the existing secret and send forged Asana events. These forged events pass signature verification, enabling the attacker to trigger workflows using controlled data, which subsequently causes genuine deliveries to be rejected.

An issue exists where the 'GET /api/logs/{service}' endpoint allows any authenticated user, including those with the viewer role, to download Frigate and nginx logs. This exposure includes auto-generated admin passwords and camera credentials contained within request query strings, which can lead to privilege escalation from a viewer to an administrator.

The Konnected integration registers an HTTP endpoint 'KonnectedView' (located in homeassistant/components/konnected/ init .py) that is configured to not require authentication. While write requests (POST and PUT) are processed by the `update sensor()` function and correctly validate the `Authorization: Bearer <token>` header, read requests (GET) are handled by a separate `get()` method that lacks any authentication checks. This allows unauthenticated read access to the endpoint.