地图 / Predictable proposal participant tokens enable unauthorized access and vote submission

Predictable proposal participant tokens enable unauthorized access and vote submission

密码学缺陷 / Use of Insufficiently Random Values / #3385434

厂商: Nextcloud
严重程度: 低危 · CVSS 3.7
赏金: $100
弱点: Use of Insufficiently Random Values
研究员: @loremipsumi
披露日期: 2026-01-04
资产: nextcloud/calendar
CVE: CVE-2025-66511

该报告还没有中文解读。

时间线

2025-10-15报告提交
2026-01-04公开披露

阅读 HackerOne 原文 ↗作者 @loremipsumi · 版权归作者与 Nextcloud 所有

同类报告

Invite tokens have Insufficient entropy in GHES Management ConsoleGitHub · 2024-01-12 on the implications of permitting procedural cullingcurl · 2025-07-22 Usage of unsafe random function in undici for choosing boundaryNode.js · 2025-01-23 The initial E2EE password generated by Rocket.Chat mobile can be recovered in a practical timescale.Rocket.Chat · 2024-10-01