Santhreal

An open redirect exists because the WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and certain authentication pages fail to validate destination URLs against allowed lists. This allows attackers to create links using the OpenAM domain that redirect users to arbitrary external sites for phishing purposes.

A cross-site request forgery issue exists in the OAuth 2.0 device authorization flow. This occurs when consent is skipped for implied-consent clients, allowing an attacker to approve device codes. By luring a logged-in user to a specially crafted page, an attacker can obtain access and ID tokens to make API calls on behalf of that user.

An open redirect and cross-site scripting issue exists that allows remote attackers to control destinations after login and logout. This is achieved by manipulating the `goto` and `gotoOnFail` parameters. Attackers can create malicious login or logout links to redirect users to phishing websites or execute scripts within the XUI to steal session cookies.

An issue exists during self-registration where the system fails to enforce the Valid Creation Attributes list. This allows anonymous attackers to set restricted attributes, such as group membership, by using the legacy self-service REST endpoint or the User Self-Service flow. By manipulating these attributes, an attacker can join administrative groups and obtain full administrative control of the system.

An open redirect issue exists because the `RelayState` is not validated when no `relayStateUrlList` is configured. This allows attackers to create single sign-on links containing a malicious `RelayState` to redirect users from the trusted origin to external phishing sites and bypass URL filters.

An incorrect authorization issue exists where record users can infer values of restricted fields. This occurs because the streaming planner utilizes indexes on fields that have restrictive SELECT permissions. An attacker can exploit this by executing full-text MATCHES, compound B-tree, or HNSW KNN (Hierarchical Navigable Small World, a graph-based index for approximate nearest neighbor search) queries against these restricted fields to determine if records contain specific guessed values or nearest vectors.

An authorization bypass exists in the `isFaqAccessibleForUser()` function, which incorrectly treats missing FAQ translations as visible to unauthenticated users. By sending a mismatched Accept-Language header to the comments and attachments API endpoints, attackers can read comments and attachment listings of unpublished or ACL-restricted FAQs. Access Control List (ACL) is a mechanism used to define which users or system processes are granted access to objects on a network.

An information disclosure issue allows record users to access values that are hidden by field-level SELECT permissions. This is achieved by accessing COMPUTED fields that derive their values from these hidden fields. Additionally, attackers can expose hidden values by using write RETURN clauses with `$before` and `$after` variables.

The CUT encoder lacks a security policy check, which allows configured security policies to be bypassed. An attacker can provide specially crafted input to be processed by the CUT encoder, potentially leading to an application crash or the leakage of sensitive data.

An open redirect issue exists where unauthenticated attackers can redirect users by providing an unverified `id token hint` to the '/oauth2/connect/endSession' endpoint. By specifying any realm client in a forged hint, attackers can redirect victims to any registered post-logout URI, which can be used to facilitate phishing attacks by leveraging the trust associated with the OpenAM host.

A cross-site scripting defect exists where the SAML message, relay state, and target URL are placed unencoded into the load-balancer cookie bounce auto-submit page. This issue is reachable when `cookieHashRedirectEnabled` is set, potentially allowing script execution in the OpenAM origin. However, an unrelated HTTP 500 failure prevents exploitation in released versions.

An email content injection issue allows unauthenticated attackers to control the wording of notification emails. This is possible through the `forgotPassword` and `register` actions on the '/json/{realm}/users' endpoint. By supplying the `subject` and `message` fields, attackers can send phishing emails using the organization's configured From address or use the registration process as a relay to send emails to arbitrary recipients.

A server-side request forgery (SSRF) issue exists where attackers with permissions to register or modify OAuth 2.0 clients can force the server to fetch internal resources. This occurs through the use of an unvalidated `jwks uri` variable. By leveraging client-authentication and ID-token validation, unauthenticated fetches can be triggered to probe internal hosts, metadata endpoints, or local files, or to cause a denial of service by exhausting request threads.

The software fails to enforce the `VLLM MAX AUDIO CLIP FILESIZE MB` limit during multimodal chat audio decoding. This allows unauthenticated clients to bypass file size restrictions by submitting oversized audio files through chat endpoints, leading to excessive consumption of memory and CPU resources during the decoding process.

A policy bypass exists in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. An attacker can bypass resource policies by processing specially crafted UHDR images, which may lead to a denial of service due to excessive memory allocation.

A division-by-zero flaw exists in the FLIF encoder. When processing an image with an incorrect value for ticks per second, the encoder crashes, leading to a denial of service.

The software uses a cryptographically weak pseudo-random number generator to create account activation and login pairing codes. The `getRandomCode()` function in `objects/functions.php` derives codes from `uniqid()`, which uses seconds and microseconds, with a single `rand()` character for padding. This significantly reduces the possible code values for a known generation second. The endpoint 'plugin/API/set.json.php?APIName=login code' can be accessed without authentication and acts as an oracle for the server's exact microtime. An unauthenticated remote attacker who guesses a valid, unexpired code can use the endpoint 'plugin/API/get.json.php?APIName=login code' to retrieve the target account's email address and a `User::getUserHash(users id, '+1 year')` value. This hash is accepted as a password for one year, allowing for full account takeover.

The software uses cryptographically weak `uniqid()` values for RTMP publish keys in LiveTransmition. This reduces key entropy to approximately one million possibilities per second of creation. An attacker with knowledge of the channel creation time can brute-force the five-digit microsecond component to forge valid stream keys and broadcast content as the channel owner.

Logged-in users can vote on password-protected and group-restricted videos because the system fails to validate video access permissions in the API like endpoint. This allows attackers to increment vote counters on videos they are not authorized to watch by calling the 'set.json.php' endpoint using `APIName` parameters.

Authenticated users can post comments on password-protected and group-restricted videos because the software fails to verify video access permissions in the `set api comment()` function. This allows attackers to submit POST requests to the comment API endpoint using arbitrary video IDs to write comments on videos they are not authorized to watch.