AuthMethodBleed
| CVE | Icon | Vulnerability name | Date | Responsible Security Disclosure by | Stars | Process | Vulnerabilities |
|---|---|---|---|---|---|---|---|
| - | AuthMethodBleed | 2026-10-02 | xet7 |  |
Found while auditing user publications after the 2026-10-02 Hall of Fame review; fixed by xet7. | The It now answers for the caller's own account only. CWE-200. Low severity: it needs an account and a username, and tells which organizations and teams that user is in and how they sign in. No CVE assigned. Fix prepared locally for the Upcoming release; not yet released. |
Details
The sign-in flow asks which login method an account uses, and the user-authenticationMethod publication answers it. It took a username from the client and published that user's login method, organizations and teams to whoever asked.
Any signed-in user could therefore look up every other user's organizations, teams and whether they sign in with a password, LDAP or OAuth.
Fix
The lookup is pinned to the caller's own account; a username given by the client no longer selects whose fields are published.
Detection
None. The fix changes what a response carries. A subscription without a signed-in user was already recorded; for a signed-in user the publication now simply answers about themselves, so there is no attempt to record in Admin Panel → Problems.
Verification
Unit tests in tests/userAuthMethodPublication.test.cjs check that the lookup is pinned to the caller, and the negative test fails on any publication that looks users up by a client-given name together with organization or team fields. The unit tests pass in the WeKan repository. There is no browser test.