Waterhunter

An issue exists in the 2FA Policy Handler component within the file `src/app/api/auth/login/route.ts` at the '/api/auth/login' endpoint. Remote manipulation of this component allows an attacker to bypass two-factor authentication and force the use of single-factor authentication.

The Room Action Handler component contains an issue within the `checkPassword()` function located in the app/src/server.js file. This flaw allows for improper restriction of excessive authentication attempts, which can be exploited remotely. The attack is characterized as highly complex and difficult to execute.

A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component.

An issue in the Provider Test-Connection Endpoint allows remote attackers to perform server-side request forgery (SSRF), a technique where the server is tricked into making unauthorized requests to internal or external resources. This occurs via an unknown function within the '/api/v1/providers/{id}/test' endpoint, specifically involving the `id` variable.

An authorization bypass exists in the Record API Endpoint within the file `src/app/api/record/route.ts`. A remote attacker can exploit this by manipulating the `Website` argument, allowing them to bypass security checks.