CVE-2026-23480

CVE-2026-23480 affects Blinko prior to version 1.8.4. The vulnerability lies in the upsertUser endpoint, which lacks superAdminAuthMiddleware, allowing any authenticated user to call it. Moreover, originalPassword is optional and, if omitted, password verification is skipped; there is also no che...