Security Research

Security Blog

Page 21

high6 min

Plaintext OAuth Token Storage: A Silent Security Risk in Your Application

A medium-severity vulnerability was discovered where OAuth tokens and API keys were stored in plaintext on the local filesystem without encryption. Despite having PBKDF2 cryptographic capabilities available in the application's dependencies, these sensitive credentials were written directly to disk, exposing users to potential credential theft and unauthorized account access.

#security#oauth#credential-storage+4 more
O
orbisai0security
Mar 28, 2026
high6 min

OAuth Tokens Exposed: Why Plaintext Credential Storage Is a Critical Mistake

A medium-severity vulnerability was discovered where OAuth tokens and API keys were being stored in plaintext on the local filesystem without any encryption. Despite having PBKDF2 cryptographic capabilities available in the project dependencies, the authentication module was writing sensitive credentials directly to disk, leaving them vulnerable to unauthorized access. This fix addresses a common but dangerous security oversight that could compromise user accounts and API access.

#security#oauth#encryption+4 more
O
orbisai0security
Mar 28, 2026
medium6 min

Plaintext OAuth Tokens: A Critical Security Flaw in Credential Storage

A medium-severity vulnerability was discovered where OAuth tokens and API keys were being stored in plaintext on the local filesystem without any encryption. Despite having PBKDF2 cryptographic capabilities available in the application's dependencies, credentials were written directly to disk, exposing users to potential token theft and unauthorized account access.

#security#oauth#encryption+4 more
O
orbisai0security
Mar 28, 2026
medium7 min

Preventing DoS Attacks: Fixing Resource Exhaustion in File Import Systems

A medium-severity vulnerability in file import functionality left applications vulnerable to Denial of Service (DoS) attacks through maliciously crafted files. By exploiting missing resource limits and validation checks, attackers could exhaust server memory with deeply nested JSON or oversized files, potentially bringing down entire services.

#security#denial-of-service#nodejs+4 more
O
orbisai0security
Mar 19, 2026
medium8 min

Defending Against Rate Limit Bypass: Securing Express Applications from IP Spoofing

A critical rate limiting vulnerability in an Express.js application allowed attackers to bypass API throttling through IP rotation and header manipulation. This fix demonstrates how improperly configured rate limiters can be circumvented through proxy networks, VPNs, and forged X-Forwarded-For headers, potentially enabling brute force attacks, credential stuffing, and resource exhaustion.

#security#rate-limiting#express+4 more
O
orbisai0security
Mar 19, 2026
medium5 min

Wildcard PostMessage Leak: How One Character Exposed User Sessions

A critical security flaw in a browser extension's authentication flow was sending sensitive session tokens and user data to any website using the wildcard "*" origin in postMessage. This vulnerability could have allowed malicious sites to intercept authentication credentials, but was fixed by restricting message delivery to the application's own origin.

#security#postmessage#browser-extension+4 more
O
orbisai0security
Mar 6, 2026
critical6 min

Fixing Session Hijacking: From Insecure Query Parameters to Secure Sessions

A critical session management vulnerability was recently patched in our application that allowed attackers to hijack user sessions by simply manipulating URL parameters. The fix addresses both client-side XSS vulnerabilities through unsafe DOM manipulation and server-side session validation issues, demonstrating how multiple security layers work together to protect user accounts.

#security#session-hijacking#xss+4 more
O
orbisai0security
Mar 6, 2026
medium5 min

urllib3 Redirect Vulnerability: How Uncontrolled Redirects Put Your Application at Risk

A medium-severity vulnerability (CVE-2025-50182) was discovered in urllib3 that fails to properly control HTTP redirects in browsers and Node.js environments. This flaw could allow attackers to redirect users to malicious sites or bypass security controls through crafted redirect chains. The vulnerability has been patched in the latest urllib3 release, and developers should update their dependencies immediately.

#security#urllib3#http-redirects+4 more
O
orbisai0security
Mar 6, 2026
medium5 min

Google OAuth Token Exposure: How a Leaked Access Token Put API Security at Risk

A medium-severity security vulnerability was discovered where a Google OAuth access token was inadvertently exposed in documentation files. This incident highlights the critical importance of secrets management and demonstrates how even non-code files can become vectors for credential leakage, potentially granting unauthorized access to Google APIs and user data.

#security#oauth#secrets-management+4 more
O
orbisai0security
Mar 6, 2026
medium5 min

Why strtok() is Dangerous: A Critical Security Fix in libscram

A medium-severity vulnerability was recently patched in libscram's SCRAM authentication implementation, replacing the unsafe strtok() function with its thread-safe alternative strtok_r(). This seemingly small change prevents potential buffer corruption, race conditions, and authentication bypass vulnerabilities that could compromise application security in multi-threaded environments.

#c-security#buffer-manipulation#thread-safety+4 more
O
orbisai0security
Mar 6, 2026
medium6 min

Insecure WebSocket Vulnerability: Why WSS Should Always Replace WS

A medium-severity vulnerability was discovered in a JavaScript streaming application where insecure WebSocket (ws://) connections were being used instead of secure WebSocket (wss://) connections. This security gap could expose sensitive data to man-in-the-middle attacks, allowing attackers to intercept and manipulate real-time communication between clients and servers.

#websocket#security#encryption+4 more
O
orbisai0security
Mar 6, 2026
high5 min

The Hidden Danger of Iterating Over Empty Maps in Go Applications

A medium-severity vulnerability was recently patched in a Go workflow runtime system where code attempted to iterate over a potentially empty map without proper validation. While this may seem like a minor oversight, such patterns can lead to unexpected behavior, logic bugs, and in some cases, exploitable security vulnerabilities when combined with other code paths.

#golang#security#code-quality+4 more
O
orbisai0security
Mar 6, 2026