Security: lin-snow/Ech0
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.MiddlewareGHSA-mqxv-9rm6-w8qc published
Jun 4, 2026 by lin-snowHigh -
Server-Side Request Forgery (SSRF) via Connect Handler fetchPeerConnectInfoGHSA-8mc6-xjpr-h98x published
May 3, 2026 by lin-snowHigh -
Comment model's Email field returned on public /api/comments endpointsGHSA-rj4g-rqgh-rx9h published
May 3, 2026 by lin-snowModerate -
PUT /api/echo/like/:id unauthenticated: anonymous callers modify any echo's fav_countGHSA-pj6q-4vq4-r8cg published
May 3, 2026 by lin-snowModerate -
OAuth redirect URI validation ignores path component, enables exchange-code theftGHSA-p64j-f4x9-wq66 published
May 3, 2026 by lin-snowHigh -
RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribersGHSA-3v85-fqvh-7rxf published
May 3, 2026 by lin-snowModerate -
Access tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTIGHSA-fpw6-hrg5-q5x5 published
May 3, 2026 by lin-snowHigh -
Authorization bypass on admin endpoints and /ws/system/logs — session tokens skip RequireScopesGHSA-hmmq-qh6g-6wgh published
Apr 13, 2026 by lin-snowHigh -
Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logsGHSA-cp79-9mwr-wr49 published
Apr 9, 2026 by lin-snowModerate -
Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup exportGHSA-4h9q-p5j4-xvvh published
Apr 9, 2026 by lin-snowHigh