Search results

Security: parseSubscriptionData accepts non-numeric timestamps, forwarding null timestamp to subscribe/unsubscribe upstream APIs

Status: Open.

#3398 In guardian/gateway;

· m75gyqbsrw-boop opened on Apr 22, 2026

Security: /unsubscribe-all/:data/:token accepts non-numeric timestamp and forwards null upstream (replay/freshness guard bypass risk)

Status: Open.

#3397 In guardian/gateway;

· m75gyqbsrw-boop opened on Apr 22, 2026

Security hardening: production dependency audit reports vulnerable packages (qs, mjml/html-minifier chain)

Status: Open.

#3396 In guardian/gateway;

· m75gyqbsrw-boop opened on Apr 22, 2026

Security: OAuth scope validation in login middleware allows under-scoped access tokens

Status: Open.

#3395 In guardian/gateway;

· m75gyqbsrw-boop opened on Apr 22, 2026

Security: login middleware does not bind OAuth token subject to active Okta session identity (session/token mixup risk)

Status: Open.

#3394 In guardian/gateway;

· m75gyqbsrw-boop opened on Apr 22, 2026

Security: Unauthenticated /email/:template endpoint exposes full transactional email templates

Status: Open.

#3393 In guardian/gateway;

· m75gyqbsrw-boop opened on Apr 22, 2026

Security: Sensitive token/path data leaked into logs via req.originalUrl in error logging

Status: Open.

#3391 In guardian/gateway;

· m75gyqbsrw-boop opened on Apr 22, 2026

Security: Unauthenticated non-PROD dev root (/) leaks internal Okta app IDs and enables backend metadata scraping

Status: Open.

#3390 In guardian/gateway;

· m75gyqbsrw-boop opened on Apr 22, 2026

Security: CSRF-prone logout actions exposed as state-changing GET endpoints (/signout and /signout/all)

Status: Open.

#3389 In guardian/gateway;

· m75gyqbsrw-boop opened on Apr 22, 2026

Security: Malformed prepopulateEmail query can trigger uncaught URIError and 500 on iframed routes

Status: Open.

#3388 In guardian/gateway;

· m75gyqbsrw-boop opened on Apr 22, 2026

Security: PKCE codeVerifier stored in base64-only (unencrypted) GU_oidc_auth_state cookie

Status: Open.

#3386 In guardian/gateway;

· m75gyqbsrw-boop opened on Apr 22, 2026

Security: No server-side email format validation for prepopulateEmail query parameter

Status: Open.

#3385 In guardian/gateway;

· m75gyqbsrw-boop opened on Apr 22, 2026