github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-06 00:22:42 -05:00
Code Issues 464 Packages Projects Releases 71 Wiki Activity

Authentication bypass: PIN validation fails to reject incorrect PINs #22

New Issue
Closed
opened 2025-11-13 11:47:44 -06:00 by GiteaMirror · 3 comments
GiteaMirror commented 2025-11-13 11:47:44 -06:00
Owner
Copy Link

Originally created by @mallendeo on GitHub (Jan 18, 2025).

I assigned an access PIN to my HomeAssistant instance, but when entering any PIN code, the system grants access regardless of whether the PIN is correct or not.

This does not happen when using only the password method though.

Image

Enabling PIN makes it insecure.

Originally created by @mallendeo on GitHub (Jan 18, 2025). I assigned an access PIN to my HomeAssistant instance, but when entering any PIN code, the system grants access regardless of whether the PIN is correct or not. This does not happen when using only the password method though. <img width="568" alt="Image" src="https://github.com/user-attachments/assets/1ece650c-fd55-4b15-8542-09b7da5adb55" /> Enabling PIN makes it insecure.
GiteaMirror commented 2025-11-13 11:47:46 -06:00
Author
Owner
Copy Link

@miloschwartz commented on GitHub (Jan 18, 2025):

Annnnnd this is why we're in beta. Thank you for finding the fix and opening the PR so quickly!

I just merged the PR and published 1.0.0-beta.7 for you to update to. In the future please send any security issues to me privately as per the security policy.

Thanks again!

@miloschwartz commented on GitHub (Jan 18, 2025): Annnnnd this is why we're in beta. Thank you for finding the fix and opening the PR so quickly! I just merged the PR and published 1.0.0-beta.7 for you to update to. In the future please send any security issues to me privately as per the security policy. Thanks again!
GiteaMirror commented 2025-11-13 11:47:46 -06:00
Author
Owner
Copy Link

@mallendeo commented on GitHub (Jan 18, 2025):

Thanks for the quick merge!

Just spotted the SECURITY.md after the fact, my bad 😬.
Will keep that in mind for next time.

@mallendeo commented on GitHub (Jan 18, 2025): Thanks for the quick merge! Just spotted the SECURITY.md after the fact, my bad 😬. Will keep that in mind for next time.
GiteaMirror commented 2025-11-13 11:47:46 -06:00
Author
Owner
Copy Link

@miloschwartz commented on GitHub (Jan 18, 2025):

Thanks for the quick merge!

Just spotted the SECURITY.md after the fact, my bad 😬. Will keep that in mind for next time.

No worries!

@miloschwartz commented on GitHub (Jan 18, 2025): > Thanks for the quick merge! > > Just spotted the SECURITY.md after the fact, my bad 😬. Will keep that in mind for next time. No worries!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#22
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?