CVE-2023-49801

Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `get_pfp` and `get_banner` routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Server is receiving through these URLs is correct. This could allow an attacker access to files they shouldn't have access to. This issue has been patched in version 1.4.0.

• CWE-22
• CWE-23
• CWE-22

• https://github.com/Lif-Platforms/Lif-Auth-Server/commit/c235bcc2ee65e4a0dfb10284cf2cbc750213efebPatch
• https://github.com/Lif-Platforms/Lif-Auth-Server/security/advisories/GHSA-3v77-pvqq-qg3fVendor Advisory
• https://github.com/Lif-Platforms/Lif-Auth-Server/commit/c235bcc2ee65e4a0dfb10284cf2cbc750213efebPatch
• https://github.com/Lif-Platforms/Lif-Auth-Server/security/advisories/GHSA-3v77-pvqq-qg3fVendor Advisory

Published

Jan 12, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49796MindsDB connects artificial intelligence models to real time…5.3
• CVE-2023-49797PyInstaller bundles a Python application and all its depende…7.8
• CVE-2023-49798OpenZeppelin Contracts is a library for smart contract devel…7.5
• CVE-2023-49799`nuxt-api-party` is an open source module to proxy API reque…7.5
• CVE-2023-4980Cross-site Scripting (XSS) - Generic in GitHub repository li…5.4
• CVE-2023-49800`nuxt-api-party` is an open source module to proxy API reque…7.5
• CVE-2023-49802The LinkedCustomFields plugin for MantisBT allows users to l…6.1
• CVE-2023-49803@koa/cors npm provides Cross-Origin Resource Sharing (CORS) …7.5
• CVE-2023-49804Uptime Kuma is an easy-to-use self-hosted monitoring tool. P…7.8
• CVE-2023-49805Uptime Kuma is an easy-to-use self-hosted monitoring tool. P…8.8
• CVE-2023-49807Stored cross-site scripting vulnerability when processing th…5.4
• CVE-2023-49809Mattermost fails to handle a null request body in the /add e…6.5