Skip to content

Fix SQL injection auth bypass in /rest/user/login (bind parameters) - #332

Open
devin-ai-integration[bot] wants to merge 1 commit into
developfrom
devin/1789000389-login-sqli-bind-params
Open

Fix SQL injection auth bypass in /rest/user/login (bind parameters)#332
devin-ai-integration[bot] wants to merge 1 commit into
developfrom
devin/1789000389-login-sqli-bind-params

fix: bug - use bind parameters in login query to prevent SQL injectio…

2ee734b
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / CodeQL failed Sep 10, 2026 in 4s

1 new alert including 1 high severity security vulnerability

New alerts in code changed by this pull request

Security Alerts:

  • 1 high

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 43 in lib/insecurity.ts

See this annotation in the file changed.

Code scanning / CodeQL

Use of password hash with insufficient computational effort High

Password from
an access to password
Loading
is hashed insecurely.
Password from an access to password is hashed insecurely.
Password from an access to clearTextPassword is hashed insecurely.
Password from an access to password is hashed insecurely.
Password from an access to password is hashed insecurely.
Password from an access to currentPassword is hashed insecurely.
Password from an access to currentPassword is hashed insecurely.
Password from an access to password is hashed insecurely.