Veille CVE

Recherche « NASA-AMMOS plandev (sequencing-server) »

1 CVE

Critique 1 Élevée 0 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « NASA-AMMOS plandev (sequencing-server) » ✕
  1. CVE-2026-71214 9.8 Critique

    NASA-AMMOS plandev (sequencing-server)

    The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.