High · published November 25, 2025
⚡ A seriously sneaky flaw is hiding in the Primakon Pi Portal! Without any authorization checks, unauthenticated attackers can create user accounts at will! 🔥 Think of it like a restaurant that lets anyone walk straight into the kitchen to put their name on the guest list without checking if they have a reservation — chaos awaits! An attacker could stroll right into the application’s local database, registering new accounts and potentially elevating their privileges. This opens the door to a world of trouble, from data breaches to social engineering attacks, leaving your system vulnerable and users at risk.
Think of it like a restaurant that lets anyone walk straight into the kitchen to put their name on the guest list without checking if they have a reservation — chaos awaits! This Broken Access Control vulnerability allows unauthenticated users to perform POST requests to the /api/v2/user/register endpoint, bypassing intended security measures that should require administrative access for user creation.
An attacker could stroll right into the application’s local database, registering new accounts and potentially elevating their privileges. This opens the door to a world of trouble, from data breaches to social engineering attacks, leaving your system vulnerable and users at risk. Patch to version 1.0.19 immediately to implement proper authorization checks on the registration endpoint. Additionally, review the security architecture to ensure reliance on external Identity Providers is strictly enforced. You can fix this! Act fast and you'll have your application secured in no time! 🛡️