Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/blnkfinance/blnk

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedGoPublished

    Blnk has an API key authorization bypass in owner and scope enforcement

    GHSA-wcr3-9x4c-f5gj

    Affected
    • Go github.com/blnkfinance/blnk <= 0.14.2
    Fixed in
    0.14.3· Vendor fix available
    Issue
    Blnk API key endpoints had an authorization issue that allowed non-master API keys to perform key-management actions outside their intended authorization boundary. In affected versions, API key operations trusted caller-controlled request values for owner and scope decisions. As a result, a non-master API key could potentially manage keys for another owner by supplying a different owner value, or create a more privileged API key by requesting broader scopes than it already had. This has been fixed by deriving the effective owner from the authenticated API key and enforcing scope coverage checks when creating new keys. Details The API key authorization flow previously trusted request data supplied by the caller when deciding which owner a key-management operation applied to and which scopes could be granted. This meant a non-master API key could potentially: - create API keys for another owner - list API keys belonging to another owner - revoke API keys belonging to another owner -…

    Recommended action: Upgrade to 0.14.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →