mirror of
https://github.com/th30d4y/OpenLearnX.git
synced 2026-05-26 19:26:33 +00:00
Stalin
86 lines
2.5 KiB
Markdown
86 lines
2.5 KiB
Markdown
# Release v2.0.4 - Security Patch
|
|
|
|
**Release Date:** May 8, 2026
|
|
|
|
## 🔒 Security Update
|
|
|
|
### Fixed
|
|
- **CRITICAL**: JWT Signature Verification Vulnerability (GHSA-223g-f5mq-gw33)
|
|
- Fixed JWT signature verification that was disabled in authentication middleware
|
|
- Prevents JWT forgery attacks and unauthorized account takeover
|
|
- All JWT tokens now properly verified with server secret key
|
|
|
|
### What Was Fixed
|
|
The application was disabling JWT signature verification with `options={"verify_signature": False}`, which allowed attackers to forge authentication tokens without the server checking the signature.
|
|
|
|
**Files Updated:**
|
|
- `backend/routes/dashboard.py` - Enabled JWT signature verification
|
|
- `backend/main.py` - Enabled JWT signature verification
|
|
- `backend/activity_logger.py` - Enabled JWT signature verification
|
|
|
|
**Changes:**
|
|
```python
|
|
# Before (Vulnerable)
|
|
decoded = jwt.decode(token, options={"verify_signature": False}, ...)
|
|
|
|
# After (Fixed)
|
|
decoded = jwt.decode(token, jwt_secret_key, algorithms=["HS256", "RS256"])
|
|
```
|
|
|
|
### Security Impact
|
|
- ✅ Tokens without valid signatures are now properly rejected
|
|
- ✅ Attackers can no longer forge authentication tokens
|
|
- ✅ Account takeover vulnerability is closed
|
|
- ✅ Server validates token authenticity using cryptographic signature
|
|
|
|
## 📦 Installation
|
|
|
|
### NPM
|
|
```bash
|
|
npm install @th30d4y/openlearnx@2.0.4
|
|
```
|
|
|
|
### Yarn
|
|
```bash
|
|
yarn add @th30d4y/openlearnx@2.0.4
|
|
```
|
|
|
|
### PNPM
|
|
```bash
|
|
pnpm add @th30d4y/openlearnx@2.0.4
|
|
```
|
|
|
|
## 📝 Changelog
|
|
|
|
- Updated package version to 2.0.4
|
|
- Created CHANGELOG.md with version history
|
|
- Security patch for JWT vulnerability (GHSA-223g-f5mq-gw33)
|
|
|
|
## 🔗 References
|
|
|
|
- **Security Advisory:** GHSA-223g-f5mq-gw33
|
|
- **CWE:** CWE-287 (Improper Authentication), CWE-347 (Improper Verification of Cryptographic Signature)
|
|
- **Severity:** Moderate (High impact, limited exposure in development configurations)
|
|
|
|
## 👥 Credits
|
|
|
|
- **Reporter:** @krrazee
|
|
- **Remediation Developer:** @0x5t4l1n
|
|
|
|
## ⚠️ Important Notes
|
|
|
|
- This is a security release and should be deployed immediately
|
|
- The JWT_SECRET_KEY environment variable must be set (already handled in app configuration)
|
|
- Previous versions (2.0.3 and earlier) are affected and should be updated
|
|
|
|
## 🚀 Next Steps
|
|
|
|
1. Install the latest version: `npm install @th30d4y/openlearnx@2.0.4`
|
|
2. Deploy to your environment
|
|
3. Verify JWT authentication is working correctly
|
|
4. Monitor for any authentication-related issues
|
|
|
|
---
|
|
|
|
For more information, visit: https://github.com/th30d4y/OpenLearnX
|