github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-07-24 19:30:44 -05:00
Code Issues 1.6k Packages Projects Releases 79 Wiki Activity

Authentication bypass: PIN validation fails to reject incorrect PINs #22

New Issue
Closed
opened 2025-11-13 11:47:44 -06:00 by GiteaMirror · 3 comments
GiteaMirror commented 2025-11-13 11:47:44 -06:00
Owner
Copy Link
Copy Source

Originally created by @mallendeo on GitHub (Jan 18, 2025).

I assigned an access PIN to my HomeAssistant instance, but when entering any PIN code, the system grants access regardless of whether the PIN is correct or not.

This does not happen when using only the password method though.

Image

Enabling PIN makes it insecure.

Originally created by @mallendeo on GitHub (Jan 18, 2025). I assigned an access PIN to my HomeAssistant instance, but when entering any PIN code, the system grants access regardless of whether the PIN is correct or not. This does not happen when using only the password method though. <img width="568" alt="Image" src="https://github.com/user-attachments/assets/1ece650c-fd55-4b15-8542-09b7da5adb55" /> Enabling PIN makes it insecure.
GiteaMirror commented 2025-11-13 11:47:46 -06:00
Author
Owner
Copy Link
Copy Source

@miloschwartz commented on GitHub (Jan 18, 2025):

Annnnnd this is why we're in beta. Thank you for finding the fix and opening the PR so quickly!

I just merged the PR and published 1.0.0-beta.7 for you to update to. In the future please send any security issues to me privately as per the security policy.

Thanks again!

@miloschwartz commented on GitHub (Jan 18, 2025): Annnnnd this is why we're in beta. Thank you for finding the fix and opening the PR so quickly! I just merged the PR and published 1.0.0-beta.7 for you to update to. In the future please send any security issues to me privately as per the security policy. Thanks again!
GiteaMirror commented 2025-11-13 11:47:46 -06:00
Author
Owner
Copy Link
Copy Source

@mallendeo commented on GitHub (Jan 18, 2025):

Thanks for the quick merge!

Just spotted the SECURITY.md after the fact, my bad 😬.
Will keep that in mind for next time.

@mallendeo commented on GitHub (Jan 18, 2025): Thanks for the quick merge! Just spotted the SECURITY.md after the fact, my bad 😬. Will keep that in mind for next time.
GiteaMirror commented 2025-11-13 11:47:46 -06:00
Author
Owner
Copy Link
Copy Source

@miloschwartz commented on GitHub (Jan 18, 2025):

Thanks for the quick merge!

Just spotted the SECURITY.md after the fact, my bad 😬. Will keep that in mind for next time.

No worries!

@miloschwartz commented on GitHub (Jan 18, 2025): > Thanks for the quick merge! > > Just spotted the SECURITY.md after the fact, my bad 😬. Will keep that in mind for next time. No worries!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#22