Security: Hardcoded Encryption Tokens Allow Account Takeover (GHSA-h75w-8xx3-q29p)

[mgjxwmxhn]

Summary

Discovered hardcoded encryption tokens in config.js:18-19 committed to this public repository:

• PASSWORD_TOKEN and AUTOSIGN_TOKEN are static and visible to anyone

These enable password decryption and authentication cookie forgery for any user.

GitHub Advisory

Full details: GHSA-h75w-8xx3-q29p

Suggested Fix

1. Generate random per-instance keys
2. Replace crypto.createCipher with bcrypt/argon2
3. Use HMAC with per-session nonces for auth cookies

Discovered by cenyuhan0324.