13 matches found
WS-2022-0447
A login bruteforce was discovered in heroiclabs/nakama. The attacker can use Authorization: Basic, represented by a base64 string containing :. So the attacker only needs to send : via the HTTP header Authorization, and check the HTTP response code 200...
WS-2022-0448
Insufficient Session Expiration exists in heroiclabs/nakama through 3.15.0. The Nakama Console session is not invalidated when the user is deleted. An old session can be used by an attacker even after the user has been deleted in a different session. The session can be used until it expires or th...
WS-2022-0450
User Enumeration via Response Timing was discovered in heroiclabs/nakama through 3.15.0. There is a significant timing difference in the login functionality of the Nakama Console for valid and invalid email addresses or usernames. An attacker is able to identify valid email addresses and username...
WS-2022-0200
Business logic error: Not able to access newly created admin account with the username admin with the password in heroiclabs/nakama through 3.12.0...
CVE-2022-2321
Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks...
CVE-2022-2321
CVE-2022-2321 affects the Nakama console (heroiclabs/nakama). The vulnerability arises from an improper restriction of excessive authentication attempts , enabling brute-force login attempts on the console. Affected condition is stated as Nakama prior to version 3.13.0. The available sources cons...
CVE-2022-2321 Improper Restriction of Excessive Authentication Attempts in heroiclabs/nakama
Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks...
CVE-2022-2306 Insufficient Session Expiration in heroiclabs/nakama
Old session tokens can be used to authenticate to the application and send authenticated requests...
CVE-2022-2321: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks...
WS-2022-0185
User Account Deletion and more via Clickjacking in heroiclabs/nakama through 3.12.0...
PT-2022-3493
Name of the Vulnerable Software and Affected Versions heroiclabs/nakama versions prior to 3.13.0 Description The issue is related to an improper restriction of excessive authentication attempts, which can lead to login brute-force attacks. This allows a remote attacker to gain unauthorized access...
Improper Privilege Management in heroiclabs/nakama
Description A predefined View Only user has access to the User Management function at the :7351//users endpoint. By default this is a predefined system administrator function, and no other users should be able to access this function. Proof of Concept - Create a View-only user with the...