CoBC Event Tracker
/gelhaus-solutions/public/cobc-et
Published advisories
Atom feedGSSA-2026-04-AMHCRRApril 25, 2026Weak default fallback secrets allow JWT and CSRF token forgery in cobc-events
cobc-events <1.0.1 fell back to hard-coded development secrets when JWT_SECRET / SESSION_SECRET were unset, allowing forgery of session JWTs and CSRF HMAC tokens.
CriticalGSSA-2026-04-P1V3KVApril 25, 2026Non-constant-time CSRF token comparison and lax hex parsing in cobc-events
The CSRF middleware in cobc-events <1.0.1 compared the cookie nonce with `!==` before the timing-safe HMAC check and accepted malformed hex input, leaking timing data and weakening token verification.
MediumGSSA-2026-04-RSDKJ2April 25, 2026Permissive CORS configuration allows credentialed cross-origin requests in cobc-events
cobc-events <1.0.1 enabled CORS with the default `cors()` configuration, accepting any `Origin`. Combined with the JWT cookie, this allowed cross-origin sites to issue authenticated requests against the API.
MediumGSSA-2026-04-4YYSARApril 25, 2026Missing HSTS and incomplete CSP directives in cobc-events
cobc-events <1.0.1 did not set Strict-Transport-Security and was missing key Content-Security-Policy directives (`frame-ancestors`, `object-src`, `base-uri`, `form-action`), enabling downgrade and clickjacking attacks.
MediumGSSA-2026-04-PR3QFFApril 25, 2026IDOR on /api/loa/user/:userId and /api/strikes/user/:userId in cobc-events
Endpoints returning another user's LoA/strikes only required `view_own_*` permission and did not enforce that the caller owned the path parameter, allowing any authenticated host to read other users' history.
MediumGSSA-2026-04-XJKMV4April 25, 2026Permissive file upload filter accepts SVG enabling stored XSS in cobc-events
The multer fileFilter in cobc-events <1.0.1 used the regex `^(image|video|application/pdf)`, which matches `image/svg+xml` and any `video/*` MIME type. SVG uploads enable stored XSS when later served from the application origin.
MediumGSSA-2026-04-RHBD5TApril 25, 2026Discord bot /config and /setchannel commands lacked authorization in cobc-events
The `/config` and `/setchannel` slash commands in cobc-events <1.0.1 had no permission check, letting any guild member toggle logging features or reroute strike/event/LoA log channels.
HighGSSA-2026-04-3ZVC5DApril 25, 2026Unbounded pagination limits enable resource exhaustion in cobc-events
Several REST endpoints accepted a client-controlled `limit` query parameter with no upper bound, allowing authenticated users to request arbitrarily large result sets and exhaust database / memory.
MediumGSSA-2026-04-8PDG13April 25, 2026Strike status filter accepted arbitrary strings in cobc-events
`/api/strikes` previously accepted any comma-separated string in `?status=` and forwarded it to the service layer without validation against the StrikeStatus enum.
MediumGSSA-2026-04-QH1CCPApril 25, 2026Cache invalidation used blocking Redis KEYS command in cobc-events
`CacheService.invalidatePattern` called `redis.keys(pattern)`, which blocks the Redis instance. On large keyspaces this could stall the entire Redis server and create a denial-of-service condition.
MediumGSSA-2026-04-TPJNF1April 25, 2026Stored XSS via manual HTML escaping in events log-outcome view in cobc-events
The `log-outcome.ejs` template used the unescaped `<%-` output tag with hand-rolled HTML escaping that did not cover all XSS vectors, allowing stored XSS via `event.notes`.
Medium