PT-2020-21408 · Simon Willison · Datasette-Indieauth

Published 2020-11-24 · Updated 2020-11-24

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions datasette-indieauth versions prior to 1.1

Description A malicious user can sign in as a user with any IndieAuth identifier due to the implementation not verifying that the final "me" URL value returned by the authorization server belongs to the same domain as the initial value entered by the user.

Recommendations For versions prior to 1.1, upgrade to version 1.1 immediately to resolve the issue.

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

GHSA-MJCR-RQJG-RHG3

Affected Products

Datasette-Indieauth

References · 5

• https://osv.dev/vulnerability/GHSA-mjcr-rqjg-rhg3 · Vendor Advisory
• https://github.com/simonw/datasette-indieauth/commit/376c8804c6b0811852049229a24336fe5eb6a439 · Note
• https://github.com/simonw/datasette-indieauth · Note
• https://github.com/simonw/datasette-indieauth/security/advisories/GHSA-mjcr-rqjg-rhg3 · Note
• https://pypi.org/project/datasette-indieauth · Note