curveball/a12n-server

curveball/a12n-server

Releases122

Frequency2 weeks 6 days

Last Release 10 months ago

Stars498

An open source lightweight OAuth2 server

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2023-22494 ↗	Jan 13, 2023Friday, 13 January 2023, 16:15	—	—
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-20018. Reason: This candidate is a reservation duplicate of CVE-2016-20018. Notes: All CVE users should reference CVE-2016-20018 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE-2021-29452 ↗	Apr 16, 2021Friday, 16 April 2021, 22:15	8.1 HIGH	4 MEDIUM
a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change. Patched in v0.18.2.