bbs

BBS The old bbs can be found here Description bbs is a router for SOCKS and HTTP proxies. It exposes SOCKS5, HTTP CONNECT or port forwarding services and forwards incoming requests to proxies or chains of proxies based on the request's target. Routing can be configured with a PAC script if built...

CVE-2026-121452

bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify...

CVE-2026-121452

The bbs-go software (versions through 4.4.6 ) is vulnerable to an improper TLS certificate validation flaw within its SMTP email service. The root cause is located in the sendEmail() function, which sets InsecureSkipVerify to true. This allows network-positioned attackers to intercept SMTP traffi...

CVE-2026-121452 bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service

bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify...

CVE-2026-121452 bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service

bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify...

CVE-2026-121452

bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify...

EUVD-2026-115884

bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify...

CVE-2026-121452: mlogclub bbs-go: bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers…

bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify...

CVE-2026-111639

bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/googleonetap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's...

CVE-2026-111639

The bbs-go application (through version 4.4.6 ) contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint. The root cause is a failure to verify the aud claim in Google-signed ID tokens, allowing remote attackers to replay tokens issued to any OAuth client. By usin...

EUVD-2026-103061

bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/googleonetap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's...

CVE-2026-111639 bbs-go through 4.4.6 Account Takeover via Google One Tap Login

bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/googleonetap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's...

CVE-2026-111639 bbs-go through 4.4.6 Account Takeover via Google One Tap Login

bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/googleonetap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's...

CVE-2026-111639 bbs-go through 4.4.6 Account Takeover via Google One Tap Login

bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/googleonetap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's...

CVE-2026-111639

bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/googleonetap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's...

PT-2026-116038

bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google one tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's...

CVE-2026-111639: Improper Authentication

bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/googleonetap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's...

mlogclub bbs-go authorization issue vulnerability

The mlogclub bbs-go versions 4.4.6 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of verification of the aud claim in the /api/login/googleonetap endpoint, allowing authentication bypass. Attackers can replay victim’s tokens to log in with the victim...

CVE-2026-110103

bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to...

CVE-2026-110103 bbs-go through 4.4.6 Stored XSS via Image Upload Content-Type

bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to...