To report a security issue or vulnerability, please create a Security Advisory draft and collaborate on a fix.
Repository navigation
Security: voidauth/voidauth
Security
SECURITY.md
-
Account MFA Not Enabled if Passkey Bypasses MFA RequirementGHSA-vxcv-g958-xqg5 published
Sep 30, 2026 by notquitenothingHigh -
Password strength requirement silently bypassed on reset and change (missing return)GHSA-ff46-892f-mgc6 published
Sep 13, 2026 by notquitenothingModerate -
ProxyAuth allows any overmatching request which starts with the APP_URLGHSA-2rjv-5h78-8xfg published
Sep 5, 2026 by notquitenothingCritical -
TOTP second factor brute-forceable via spoofable X-Forwarded-ForGHSA-cjxc-rf3w-gjx2 published
Sep 5, 2026 by notquitenothingModerate
Learn more about advisories related to voidauth/voidauth in the GitHub Advisory Database