4 ms·
Magic links to email and sms, which are unencrypted, for signup and login, account linking and then converting the session cookies to valid jwt? I smell a CVE
by moi2388 3y ago
Magic links to email and sms, which are unencrypted, for signup and login, account linking and then converting the session cookies to valid jwt?
I smell a CVE within a year.
- toomuchtodo 3y agoAll password resets lead back to email.