See how aptabase compares to other vendors in security performance
Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTHSECRET. Attackers can enumerate registered e-mails via /api/auth/signin, forge HS256 JWTs redeemed by /api/auth/continue, impersonate users, export analytics data, and transfer app ownership.
Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTHSECRET. Attackers can enumerate registered e-mails via /api/auth/signin, forge HS256 JWTs redeemed by /api/auth/continue, impersonate users, export analytics data, and transfer app ownership.