WS-2019-0498

Passbolt implements a mechanism to verify the server's authenticity. The /auth/verify.json endpoint used to verify the server's authenticity returns a JSON that displays errors that occurred during the request. An attacker could use this unauthenticated endpoint to enumerate users registered on a...

WS-2019-0497

Passbolt uses three cookies: a session cookie, a CSRF protection cookie and a cookie to keep track of the multiple-factor authentication process. Both the session cookie and the mfa cookie are properly set HTTP-only to prevent an attacker from retrieving the content of those cookies if they manag...