Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-61609

  CVE-2026-61609: Pterodactyl Panel Global Authentication Rate-Limit DoS

  A missing key on Pterodactyl's login rate limiter creates one shared counter for all users, so an attacker sending 10 requests per minute from a single IP locks every user out of the panel.

• highCVE-2026-45293

  CVE-2026-45293: WordPress Coding Standards (WPCS) Eval Injection via EnqueuedResourceParameters Sniff

  A code linting tool (WordPress Coding Standards) executed arbitrary OS commands on the developer or CI machine that ran it, just by scanning a maliciously crafted PHP file.

• highCVE-2026-55771

  CVE-2026-55771: CedarJava EntityIdentifier Incorrect Equality Comparison

  CedarJava's EntityIdentifier.equals() method has its null-check and self-reference-check logic inverted, causing it to return true when compared to null and false when compared to itself, which can…

• criticalCVE-2026-46428

  CVE-2026-46428: lettre Inverted Boolean Disables TLS Hostname Verification (boring-tls)

  A flipped boolean in the lettre Rust email library silently turns off TLS hostname verification for every app using the boring-tls backend with default-strict settings, letting an on-path attacker…

• highCVE-2026-47427

  CVE-2026-47427: github-mcp-server Nil Pointer Dereference DoS in completion/complete Handler

  Any unauthenticated client can crash GitHub's official MCP Server by sending a malformed completion request with a missing ref field, triggering an unrecoverable Go runtime panic before any auth…

• highCVE-2026-54545

  CVE-2026-54545: @wakaru/cli Arbitrary File Write via Path Traversal in --unpack

  A crafted JavaScript bundle can trick the @wakaru/cli unpacker into writing extracted module files outside the intended output directory, potentially enabling code execution.

• highCVE-2026-43983

  CVE-2026-43983: Pocket ID OIDC Refresh Token Authorization Bypass

  Pocket ID's OIDC token endpoint keeps issuing new access tokens via refresh even after a user is disabled, loses group membership, or explicitly revokes a client's authorization, letting a…

• highCVE-2026-43910

  CVE-2026-43910: appium/java-client SSRF via Unvalidated directConnect Redirect

  A rogue Appium server can silently redirect all test session traffic to any attacker-controlled host by injecting arbitrary values into the directConnect fields of a NEW_SESSION response, with no…

• criticalCVE-2026-62263

  CVE-2026-62263: OpenAM WebAuthn ObjectInputFilter depth>1 Deserialization RCE

  A broken serialization filter in OpenAM's WebAuthn module only checks the root object in a Java serialization stream, leaving every nested class unchecked, so an attacker can hide a gadget chain…

• high

  OpenList Authenticated Path Traversal in Batch Rename src_name

  A logged-in OpenList user can rename files outside their assigned base directory by injecting dot-dot path segments into the batch rename API, letting them corrupt or displace other users' files.

• high

  CVE-2026-33413: etcd Watch API RBAC Authorization Bypass via Open-Ended Range

  A user with read permission on a single etcd key can use the Watch API with an open-ended range option to receive events for every key in the store, completely bypassing RBAC controls.

• criticalCVE-2026-62379

  CVE-2026-62379: OpenAM Unauthenticated Remote Code Execution via Unsafe Reflection in AuthXMLUtils

  OpenAM's pre-authentication XML endpoint lets any unauthenticated attacker name an arbitrary Java class in a request, which the server loads and runs, giving full control of the machine.