CVE-2025-48051

powertip.ts in Lila for Lichess before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM node and interpreted as HTML...

Lichess: Open Redirect Vulnerability in OAuth Flow Leading to Potential Phishing Attack

Summary: An open redirect vulnerability exists in the OAuth flow on lichess4545.com. By manipulating the redirecturi parameter during the OAuth authorization process with Lichess, an attacker can redirect users to an arbitrary external domain e.g., example.com after login. This could be exploited...

Lichess: Weak Rate Limiting Controls in the (LOGIN) page Expose System to Brute Force and DoS Attacks

Summary: The login page lacks proper rate limiting, allowing an attacker to easily perform a brute-force attack. This vulnerability enables the attacker to systematically try different username and password combinations until they successfully compromise any account, which poses a significant...

Lichess: Direct IP Access to Website

Summary: The website is accessible directly via its IP address 37.187.205.99, which may bypass domain-based security policies and expose potential misconfigurations. Steps To Reproduce: 1. Open a web browser and enter the IP address: http://37.187.205.99 2. Observe that it loads the main website...

Malicious code in lichess-org (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cdb65e3664911d5ab4ab82caebca6255a38c6a150a4345389d6c934598101390 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-202 Malicious code in lichess-org (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cdb65e3664911d5ab4ab82caebca6255a38c6a150a4345389d6c934598101390 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

lichess • Free Online Chess - BSD license, MIT license, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application lichess • Free Online Chess published at the 'play' market has multiple vulnerabilities...