PT-2026-6421

Summary 1. A hardcoded secret key used for signing JWTs is checked into source code 2. ManyAPI routes do not check authentication Details I am using the publicly available docker image at ghcr.io/maziggy/bambuddy 1. Hardcoded JWT Secret Key...

PT-2023-21367

Name of the Vulnerable Software and Affected Versions Mattermost affected versions not specified Description The issue allows a regular user to send install requests to the Apps because it fails to verify if the requestor is a sysadmin or not before allowing install requests. Recommendations At t...