###### ZEROPATH WALL OF FAME

# Securing the world's code, one vulnerability at a time

Every vulnerability listed here has been discovered and responsibly disclosed by ZeroPath. This represents just a fraction of our ongoing mission to make open source software more secure.

41

Vulnerabilities Fixed

+25

In Disclosure Process

6

CVEs Assigned

## Discovered Vulnerabilities

Each finding represents hours of research and responsible disclosure to protect users worldwide

### CVE-2025-14777

Insecure Direct Object Reference (IDOR)

#### IDOR in Keycloak Admin API Authorization Resource Management

Keycloak's admin authorization API validates permissions against the client ID in the request but performs backend update/delete operations using only the resource ID. An authenticated admin scoped to one client can modify or delete another client's authorization resources in the same realm by supplying a valid target resource ID.

keycloak/keycloak

[View CVE Details](https://nvd.nist.gov/vuln/detail/CVE-2025-14777)

### CVE Pending 2026-02-02

Cross-Origin WebSocket Hijacking

#### Credential Theft via Cross-Origin WebSocket Hijacking in Openclaw

Openclaw's browser relay server accepts Chrome DevTools Protocol commands from any local connection without origin validation. Malicious JavaScript on any website can connect to the WebSocket endpoint and execute arbitrary commands in other browser tabs, stealing session cookies and credentials.

openclaw/openclaw

[View on GitHub](https://github.com/openclaw/openclaw/security/advisories/GHSA-mr32-vwc2-5j6h)

### CVE Pending 2025-11-11

Remote Code Execution

#### Unauthenticated RCE via Path Traversal in sudo logsrvd

The sudo log server (logsrvd) accepts client-supplied values for log path expansion without sanitization. An attacker can inject path traversal sequences to write arbitrary files as root, achieving code execution via cron. No authentication is required in the default configuration.

sudo-project/sudo

[View on GitHub](https://github.com/ZeroPathAI/public-pocs/blob/main/sudo/logsrvd_rce_poc.py)

### CVE Pending 2025-11-08

Privilege Escalation

#### Privilege Drop Failure in sudo exec_mailer

The exec_mailer() function calls setuid() to drop privileges but does not check the return value on failure, and never drops group privileges. If setuid() is blocked, sudo silently continues running the mailer as root.

sudo-project/sudo

[View on GitHub](/content/blog/sudo-bug-fixes/index.html)

### CVE Pending 2025-11-06

Improper Authentication

#### django-allauth uses mutable provider attribute as UID

The provider handler uses preferred_username from Okta and NetIQ as the canonical UID instead of the stable sub claim. Because preferred_username is mutable and not globally unique, an attacker can change it to match another account and cause account takeover or incorrect account linking.

pennersr/django-allauth

[View on GitHub](https://codeberg.org/allauth/django-allauth/commit/8feef46e0e07b25fc5594c8f268afa247ebc3412)

### CVE Pending 2025-11-06

Improper Authorization

#### Tokens issued to disabled users due to missing account-state check

After resolving the user from device authorization data, the flow allows token minting without verifying required account state such as user.is_active. If an account was disabled after device authorization, tokens may still be issued unless downstream validators block it.

pennersr/django-allauth

[View on GitHub](https://codeberg.org/allauth/django-allauth/commit/c54edf947c5a1c8c4ff3cddb75c86000ecb2507d)

### CVE Pending 2025-11-06

Improper Authentication

#### Notion provider marks email as verified without validation

The Notion provider extract_email_addresses handler sets verified=true and primary=true unconditionally. It does not check an email_verified flag or other evidence that Notion verified the address, enabling account linking or creation that bypasses normal email verification controls.

pennersr/django-allauth

[View on GitHub](/content/blog/django-allauth-account-takeover-vulnerabilities/index.html)

### CVE Pending 2025-11-06

Information Disclosure

#### Recovery Codes Download Endpoint Missing Cache-Control Headers in django-allauth

The recovery codes download view lacks Cache-Control and Pragma headers, allowing proxy or browser caching of sensitive MFA recovery codes that should never be stored outside the user's immediate session.

pennersr/django-allauth

[View on GitHub](/content/blog/django-allauth-account-takeover-vulnerabilities/index.html)

### CVE Pending 2025-11-06

Insecure Transport

#### Insecure HTTP URLs Used for OAuth Provider Endpoints in django-allauth

Over 10 OAuth provider configurations use http:// instead of https:// for endpoint URLs, including Amazon, Baidu, Flickr, Instagram, Tumblr, X/Twitter, Vimeo, Weibo, and Yahoo, exposing OAuth tokens to network interception.

pennersr/django-allauth

[View on GitHub](/content/blog/django-allauth-account-takeover-vulnerabilities/index.html)

### CVE Pending 2025-11-06

Encoding Bug

#### URI Quoting Relies on Non-Deterministic Set Iteration in django-allauth

URI quoting logic iterates over a set() of unsafe characters with non-deterministic ordering. This can cause double-encoding of percent characters when replacement order matters, potentially breaking OAuth callback URLs.

pennersr/django-allauth

[View on GitHub](/content/blog/django-allauth-account-takeover-vulnerabilities/index.html)

### CVE Pending 2025-10-21

Heap Buffer Overflow

#### Android MediaCodec audio: Buffer overflow due to truncated sample count

In mediacodec_wrap_sw_audio_buffer(), allocating a buffer based on a truncated sample count (due to integer division) followed by a full-size memcpy results in a heap buffer overflow. Reachable via attacker-provided media through Android MediaCodec APIs.

https://code.ffmpeg.org/

[View on GitHub](https://www.ffmpeg.org/)

### CVE Pending 2025-10-21

Heap Buffer Overflow

#### RTMP client: Buffer overflow via unbounded AMF serialization

The RTMP client (gen_connect) allocates a fixed-size packet buffer but writes arbitrary AMF fields derived from the rt->conn string into it without checking remaining capacity, causing a heap buffer overflow.

https://code.ffmpeg.org/

[View on GitHub](https://www.ffmpeg.org/)

### CVE Pending 2025-10-21

Stack Buffer Overflow (Off-by-One)

#### ICY metadata: Off-by-one NUL stack corruption

In store_icy(), the code writes a NUL byte at data[len + 1] instead of data[len] for the maximum allowed metadata size, corrupting adjacent stack state and potentially enabling memory corruption or denial-of-service.

https://code.ffmpeg.org/

[View on GitHub](https://www.ffmpeg.org/)

### CVE Pending 2025-10-21

Remote Buffer Overflow

#### RTP RFC4175 video: Buffer overflow due to integer overflow

The calculation of 'copy_offset' in rfc4175_handle_packet() did not account for massive numerical values, causing integer wrapping that bypassed the buffer size protection check and led to a buffer overflow.

https://code.ffmpeg.org/

[View on GitHub](https://www.ffmpeg.org/)

### CVE Pending 2025-10-21

Out-of-Bounds Write (Negative Size)

#### QDM2-over-RTP: Invalid memory write with negative memcpy length

The QDM2 parser reads an unvalidated 'block_size' from an RTP config packet. If 'block_size' is too small for the header, the copy length becomes negative, leading to an out-of-bounds write via memcpy.

https://code.ffmpeg.org/

[View on GitHub](https://www.ffmpeg.org/)

### CVE Pending 2025-10-21

Heap Buffer Overwrite

#### drawtext filter: Buffer overwrite due to separator budgeting error

When using detection bounding boxes in the drawtext filter, concatenating labels and ',