Skip to content

v1.1.1

Choose a tag to compare

View all tags
@mxcd mxcd released this 30 Oct 23:47
· 9 commits to main since this release
v1.1.1
ef43813
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security fix for the password provider. No API or configuration change.

Fixed

  • password: a login pending its second factor (or its TOTP enrollment) is now bound to the credentials its password step verified. When the password or the second factor changes before the second step, TOTP verify ends the pending login with no_pending_login, and setup and enable of a pending enrollment refuse the same way. Before, an attacker holding the old password plus a TOTP or backup code could complete a login started before a password reset within PendingTTL (default 5 minutes) and keep a session that passed every refresh (D61). Found by security review run 3.

Upgrade notes

  • Logins that are waiting for their second factor while you deploy carry no credential stamp and answer no_pending_login once; the user logs in again.

Image: ghcr.io/govengers/forwardauth:1.1.1 (the image has no password provider; it is rebuilt for the release).

Assets 2
Loading