5 matches found
EUVD-2026-116586
SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the...
CVE-2026-121728
SourceHut meta.sr.ht versions 0.56.11 through 0.89.0 are vulnerable to an authorization bypass that allows unauthenticated attackers to register accounts even when public registration is disabled. The root cause is an unchecked GraphQL RegisterAccount mutation triggered by POSTing credentials to ...
CVE-2026-121728 SourceHut meta.sr.ht 0.56.11 before 0.89.0 Registration Authorization Bypass via /register/step2
SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the...
