- Shipped
- August 2, 2026 at 6:22 PM UTC
- Author
- kamo
- Commit
- 84cb726
Both routes were dead — no caller anywhere in kamo-internal, kamo-login or kamo-register — and both leaked credentials. /api/set-token built its upstream URL from an attacker-controlled ?domain= and forwarded the caller's entire inbound Cookie header to it, so a link to **************** exfiltrated the victim's session. Its POST half accepted an arbitrary JWT from the request body and wrote it into the httpOnly kam_at cookie — unauthenticated session injection. /api/get-jwt-token read the httpOnly kam_at cookie and returned its value as JSON, making the bearer readable by any script and defeating httpOnly entirely. Add source-level guards under app/lib/security so neither defect class can return: no route may relay the caller's Cookie header upstream, and no route may return an auth cookie value in a response body. api/logout is an explicit, documented exception — it must send cookies to the sibling login domain to destroy the session there, and derives that host server-side rather than from a request parameter. Also add the enterprise HIPAA readiness assessment these were found by.