winfunc

Hacking the old HackerNews codebase

Mufeed VH — Sat, 18 Apr 2026 00:00:00 GMT

Auditing the old HackerNews codebase for security vulnerabilities with LLMs on a specialized harness.

What an automated vulnerability research system actually found

Mufeed VH — Thu, 26 Mar 2026 00:00:00 GMT

Thirteen patched bugs across nine projects, including Node.js, React, NGINX, Mattermost, Supabase, Bun, Gumroad, Anthropic's MCP SDK, and Better-Auth. What the system got right, where it still falls over, and why executable PoCs matter more than model reasoning.

How Asterisk Works

Mufeed VH — Fri, 30 Aug 2024 00:00:00 GMT

stream accepts revoked client certificates despite ssl_ocsp on (CVE-2026-28755)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

When a `stream` listener is configured with both `ssl_verify_client on` and `ssl_ocsp on`, nginx performs the OCSP request and learns that the presented client certificate is revoked, but it still completes the TLS handshake and allows the session to reach application data. The root cause is a logic gap specific to `stream`: the OCSP helper records revocation state, but the `stream` verification path in `ngx_stream_ssl_handler()` checks only `SSL_get_verify_result()` and whether a certificate i...

SCGI unbuffered mode sent truncated CONTENT_LENGTH causing backend desync

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

In the SCGI module, `ngx_http_scgi_create_request()` historically derived `CONTENT_LENGTH` by summing the currently buffered request-body chain (`r->upstream->request_bufs`). This behavior was introduced to support chunked-body accounting, but it becomes inaccurate when `scgi_request_buffering off` is used and the body is still streaming. With unbuffered request forwarding, only an early body prefix may be available when SCGI headers are serialized. The emitted SCGI netstring can therefore adve...

RSC reply decoder DoS via $K FormData amplification (CVE-2026-23864)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

The server-side React Flight reply decoder treats `$K` tokens as **nested FormData** and reconstructs them by scanning the backing request form and copying entries into a new `FormData`. Because the decoder performs a full scan and allocation **for every `$K` occurrence** with no global limits, an attacker can embed thousands of `$K` tokens in a small multipart payload and force the server to allocate tens of MB of heap while decoding. This creates a high-amplification DoS that is remotely r...

Permission model bypass via unchecked Unix Domain Socket connections (CVE-2026-21636)

Winfunc Research — Wed, 01 Jan 2025 00:00:00 GMT

Node.js permission model **fails to enforce network restrictions for Unix Domain Socket (UDS) connections**. With `--permission` enabled and **without** `--allow-net` (or any allowlists), an attacker-controlled URL or `socketPath` still reaches arbitrary local sockets via `net`, `tls`, or `undici`/`fetch`. This breaks the security boundary the permission model is meant to provide and enables SSRF-to-local-RCE style impact against local daemons (e.g., Docker API) while the administrator believes ...

Authentication bypass on FastMCP custom routes

Winfunc Research — Wed, 01 Jan 2025 00:00:00 GMT

`FastMCP.custom_route()` allows developers to mount arbitrary HTTP handlers intended for sensitive use cases such as OAuth callbacks or admin APIs, but it never applies `RequireAuthMiddleware` even when the server is configured with a token verifier. Only the built-in SSE and StreamableHTTP endpoints are wrapped; custom routes are appended to the Starlette app as-is while Starlette’s `AuthenticationMiddleware` merely records credentials without rejecting unauthenticated requests. As a result any...

SQL Injection via queueName in getDatabaseQueuesMetrics

Winfunc Research — Wed, 01 Jan 2025 00:00:00 GMT

`getDatabaseQueuesMetrics` builds SQL statements with `queueName` interpolated directly into table identifiers and literals. The `queueName` value originates from the route parameter (`/integrations/queues/queues/:queueName`) which is attacker-controllable. No validation or quoting is applied before the SQL is sent to `executeSql`, allowing crafted queue names to break out of the identifier context and execute arbitrary SQL statements against the project database....

Exponential merge keys in Bun's YAML implementation leads to DoS

Winfunc Research — Wed, 01 Jan 2025 00:00:00 GMT

`Bun.YAML.parse` materialises YAML mappings by iterating every merge (`<<`) entry and blindly appending the referenced property list to the target object (`src/bun.js/api/YAMLObject.zig:1034-1045`). Because the loop does not track merge depth or repeated anchors, an attacker can craft a document where each level merges all previous anchors (`<<: [*a0, *a1, …]`). The parser repeatedly copies the entire accumulated property array for each level, resulting in exponential work while the payload rema...

0-click Account Takeover and Admin Operations via helper endpoint authorization bypass

Winfunc Research — Wed, 01 Jan 2025 00:00:00 GMT

The helper endpoint responsible for updating user email addresses performs a sensitive account mutation without performing any authentication or authorization beyond confirming that an `Authorization` header exists. `Api::Internal::Helper::BaseController#verify_authorization_header!` only checks for the header’s presence and does not enforce a signature, token, or identity check unless an action explicitly invokes `authorize_hmac_signature!` or `authorize_helper_token!`. The `UsersController` ne...

SSRF bypass via IPv4-mapped IPv6 literals in IsReservedIP (CVE-2026-2455)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

The `IsReservedIP` helper is responsible for blocking requests to internal addresses before Mattermost performs outbound HTTP(S) fetches (image proxy, link previews, marketplace, SAML metadata, etc.). The function iterates a list of IPv4-only CIDRs to decide whether an IP should be rejected. However, when an attacker supplies the address as an IPv4-mapped IPv6 literal (e.g. `[::ffff:127.0.0.1]`), Go hands the resolver a 128-bit IPv6 struct, so none of the IPv4 ranges match and the address is tre...

DoS via unchecked User-Agent token in getBrowserVersion (CVE-2026-25783)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

`getBrowserVersion` in `server/channels/app/user_agent.go` slices the first token following Mattermost-specific identifiers (e.g., `Mattermost Mobile/`) without validating that a token exists. Because HTTP User-Agent headers are fully attacker-controlled, the substring can be empty or whitespace-only, causing `strings.Fields(...)[0]` to panic (`runtime error: index out of range`). Any unauthenticated request that reaches `DoLogin` (and other paths that collect browser metadata) crashes the handl...

Unbounded PBKDF2 hashing allows remote login DoS via oversized passwords (CVE-2026-24458)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

The `PBKDF2.CompareHashAndPassword` function accepts attacker-controlled plaintext passwords during authentication without enforcing the global `PasswordMaxLengthBytes` guard that is used when hashing passwords for storage. As a result, login attempts with multi-megabyte passwords are processed by PBKDF2 with 600k iterations over the full input. Each request can monopolize CPU and memory for hundreds of milliseconds, allowing a remote attacker to send a small number of large password attempts to...

Private Channel Enumeration via /mute Slash Command (CVE-2026-21386)

Winfunc Research — Thu, 01 Jan 2026 00:00:00 GMT

The `MuteProvider.DoCommand` handler allows a user to specify `~channel-handle` to toggle the mute state of any channel. Instead of using an authorization-aware helper, it directly calls `Store().Channel().GetByName()` which returns private channel metadata without verifying membership. The command then returns two different localized errors: `api.command_mute.error` when a channel truly does not exist, and `api.command_mute.not_member.error` when `ToggleMuteChannel` fails because the caller is ...

Multi-session sign-out hook allows forged cookies to revoke arbitrary sessions

Winfunc Research — Wed, 01 Jan 2025 00:00:00 GMT

The `multiSession` plugin's `/sign-out` after-hook (`packages/better-auth/src/plugins/multi-session/index.ts`) blindly trusts every cookie whose name matches the `_multi-` pattern. The handler splits the first segment of each raw cookie value and forwards the resulting strings to `ctx.context.internalAdapter.deleteSessions(...)` without ever calling `ctx.getSignedCookie` or verifying an HMAC. Because the Cookie header is entirely attacker-controlled, any authenticated user who learns another ac...