there is a serious bug in KeyHelp 20.2 authentication

sanxh · Post by **sanxh** » Sat 29. Aug 2020, 19:42

there is a serious bug in KeyHelp 20.2 authentication.

Login in your browser, copy the the current session ID URL and paste it in another browser, it opens the admin panel.
No need to login again.
https://x.x.x.x/index.php?page=admin_da ... kkr3r54353

christian.john · Post by **christian.john** » Sun 30. Aug 2020, 06:53

I got a message, your session is invalid.

Post by **Tobi** » Sun 30. Aug 2020, 10:18

The session id is connected with your IP.

As long as you don't share the URL within your LAN there's no security issue.

We also have a german thread about this topic.
viewtopic.php?f=6&t=355

Post by **Alexander** » Tue 1. Sep 2020, 15:21

As Tobi has already mentioned, in the current KeyHelp version the session is bound to your IP.

Furthermore I have now implemented several additional security measures to protect against other attack vectors.
All part of the upcoming KeyHelp 20.3.

sanxh · Post by **sanxh** » Wed 2. Sep 2020, 14:05

Alexander wrote: ↑Tue 1. Sep 2020, 15:21 As Tobi has already mentioned, in the current KeyHelp version the session is bound to your IP.

Furthermore I have now implemented several additional security measures to protect against other attack vectors.
All part of the upcoming KeyHelp 20.3.

When is release 20.3?

thanks

Post by **Alexander** » Wed 2. Sep 2020, 14:12

It should be ready in September - but no guarantee for that.

there is a serious bug in KeyHelp 20.2 authentication [SOLVED]

there is a serious bug in KeyHelp 20.2 authentication

Re: there is a serious bug in KeyHelp 20.2 authentication

Re: there is a serious bug in KeyHelp 20.2 authentication

Re: there is a serious bug in KeyHelp 20.2 authentication

Re: there is a serious bug in KeyHelp 20.2 authentication

Re: there is a serious bug in KeyHelp 20.2 authentication [SOLVED]