Description
Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validating the access token, resulting in authentication bypass. The function `this.authProvider.verifyAccessKey` is an async function, as the code is not using `await` to wait for the verification result. Every time the function responds back with success, along with an unhandled exception if the token is invalid. A patch is available in version 2.6.0.
References (3)
Core 3
Core References
Patch, Third Party Advisory x_refsource_confirm
https://github.com/ramank775/chat-server/security/advisories/GHSA-xx4j-qqpp-v277
Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/ramank775/chat-server/discussions/78
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/ramank775/chat-server/releases/tag/v2.6.0
Scores
CVSS v3
9.1
EPSS
0.0137
EPSS Percentile
68.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-20
CWE-287
Status
published
Products (1)
chat_server_project/chat_server
2.3.2 - 2.6.0
Published
May 31, 2022
Tracked Since
Feb 18, 2026