mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-22 07:02:16 +03:00
0c52533e01
The OAuth import and auto-import routes create or read provider credentials (connection injection, Cursor token disclosure), but guarded only with isAuthenticated() — which, because /api/oauth/ is PUBLIC-classified, accepts any valid client API key. All ten routes now go through requireManagementAuth, so a non-manage key gets 403 (401 with no credential) while a dashboard session or manage-scope key still works. Default requireLogin=true is unaffected for legitimate operators; keyless requireLogin=false stays open by design. Reported by @EQSTLab via GHSA-mg76-rhpx-gvw3 and @koyokr via GHSA-gxv4-955v-v6cm.