The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role using getHasuraSession. This function prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims. There is no verification that the request actually originated from Hasura, leading to missing authentication for a critical function (CWE-306). This flaw allows an attacker to spoof session roles and bypass authorization controls.

An attacker can supply arbitrary session variables in the JSON request body to impersonate different roles without proper verification. This can lead to unauthorized access, privilege escalation, and full compromise of the sequencing-server's functions, impacting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the sequencing-server to trusted clients only and implement additional request validation to ensure session variables are not accepted directly from clients without verification.