Threats tagged 'ghsa-jc78-2hw2-8h3g'

Zipline versions before 4.6.5 have a time-of-check to time-of-use (TOCTOU) race condition in the POST /api/setup endpoint. This flaw allows unauthenticated attackers to create multiple SUPERADMIN accounts by sending concurrent requests before the firstSetup flag is reset. Exploitation requires racing requests with spoofed X-Forwarded-For headers during the argon2 password hashing process. This vulnerability can lead to full administrative control of the affected Zipline instance.