CVE-2021-27935

Name of the Vulnerable Software and Affected Versions: AdGuard versions prior to 0.105.2

Description: An issue was discovered where an attacker who obtains a user's cookie can bruteforce their password offline. This is possible because the hash of the password is stored in the cookie.

Recommendations: For versions prior to 0.105.2, update to version 0.105.2 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application that use the stored password hash until a patch is applied. Avoid using the application with sensitive accounts until the issue is resolved.