[CRITICAL] SSRF/Auth Bypass via x-internal-token header #197

New issue

Open

opened 2026-06-03 00:57:34 -04:00 by zgaetano · 0 comments

zgaetano commented

2026-06-03 00:57:34 -04:00

Owner

I discovered an internal service token (x-internal-token) could be passed from external requests to bypass authentication and execute actions as the seeded admin (DEV_USER).

The isInternalCall function only checked if the header matched INTERNAL_TOKEN, but didn't verify the IP/source.

The fix was applied in fix/audit-remediation but this needs to be tracked.

I discovered an internal service token (`x-internal-token`) could be passed from external requests to bypass authentication and execute actions as the seeded admin (`DEV_USER`). The `isInternalCall` function only checked if the header matched `INTERNAL_TOKEN`, but didn't verify the IP/source. The fix was applied in `fix/audit-remediation` but this needs to be tracked.