Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• high

  http4s-blaze-server HTTP/1.1 Request Smuggling (Multiple Parser Laxities)

  Blaze's hand-written Java HTTP/1.1 parser accepts several malformed request forms that stricter front-end proxies interpret differently, letting an attacker smuggle hidden requests through a proxy to…

• high

  blaze-server HTTP/1.1 Chunked Trailer Header Injection

  A flaw in http4s blaze-server lets an attacker inject arbitrary HTTP headers by placing them in chunked-body trailer fields, bypassing any header sanitization a front-end proxy already performed.

• high

  Budibase Email Change IDOR Allows Full Account Takeover via POST /api/v2/email

  A logged-in Budibase account-portal user can redirect the email-change workflow to any victim account by supplying the victim's accountId in the request body, take over the victim's inbox, then reset…

• high

  Budibase MongoDB Integration NoSQL Operator Injection

  A BASIC app user in Budibase can override a builder-scoped MongoDB query filter by injecting MongoDB operators through an unescaped Handlebars binding, reading every document in the collection…

• high

  Budibase REST Datasource SSRF via DNS Rebinding (undici dispatcher bypasses IP pin)

  An authenticated Budibase builder can configure a REST datasource pointing at a DNS rebinding domain to make the server fetch from internal-only services, leaking cloud credentials, CouchDB contents…

• high

  Budibase: DNS Rebinding SSRF Bypass in OpenAPI Import and REST Query Execution

  A builder-level user can trick Budibase into connecting to loopback or private-network services by using a DNS rebinding hostname that passes the SSRF blacklist check but resolves to an internal…

• high

  CVE-2026-50132: Budibase Chat-Link Handoff Identity Confusion CSRF

  An attacker who has a Budibase account in the same tenant can trick any authenticated user into permanently linking the attacker's Slack, Discord, or MS Teams identity to the victim's Budibase…

• high

  GitPython Environment-Variable Exfiltration via Repo.create_remote() URL

  Passing a URL containing shell variable syntax like ${AWS_SECRET_ACCESS_KEY} to Repo.create_remote() causes GitPython to expand live process secrets into .git/config and transmit them to an…

• high

  @anephenix/hub WebSocket RPC Waiter Resource Exhaustion

  Any unauthenticated attacker can crash an @anephenix/hub server by opening many WebSocket connections and never responding, causing the server to accumulate unlimited background timers and memory…

• high

  vantage6 Algorithm Store: Incorrect Authorization on Algorithm Edit Endpoint

  Any authenticated algorithm developer in a vantage6 algorithm store can overwrite another developer's pending algorithm entry, including swapping the Docker image, so a malicious image can be…

• critical

  Pheditor: Authentication Bypass in Forced Password-Change Flow

  Pheditor's 'change default password' flow never checks whether the submitted password is actually correct, so anyone can set a new admin password and take over the editor without knowing the old one.

• high

  Poweradmin: API Broken Access Control Allows Non-Admin to Reset Any User's Password

  A delegated user-manager in Poweradmin can send one API request to overwrite the administrator's password and fully take over the instance, because the REST API skips two authorization guards that…