Issues

• Security: parseSubscriptionData accepts non-numeric timestamps, forwarding null timestamp to subscribe/unsubscribe upstream APIs

  guardian/gateway#3398 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: /unsubscribe-all/:data/:token accepts non-numeric timestamp and forwards null upstream (replay/freshness guard bypass risk)

  guardian/gateway#3397 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security hardening: production dependency audit reports vulnerable packages (qs, mjml/html-minifier chain)

  guardian/gateway#3396 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: OAuth scope validation in login middleware allows under-scoped access tokens

  guardian/gateway#3395 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: login middleware does not bind OAuth token subject to active Okta session identity (session/token mixup risk)

  guardian/gateway#3394 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: Unauthenticated /email/:template endpoint exposes full transactional email templates

  guardian/gateway#3393 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: Sensitive token/path data leaked into logs via req.originalUrl in error logging

  guardian/gateway#3391 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: Unauthenticated non-PROD dev root (/) leaks internal Okta app IDs and enables backend metadata scraping

  guardian/gateway#3390 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: CSRF-prone logout actions exposed as state-changing GET endpoints (/signout and /signout/all)

  guardian/gateway#3389 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: Malformed prepopulateEmail query can trigger uncaught URIError and 500 on iframed routes

  guardian/gateway#3388 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: PKCE codeVerifier stored in base64-only (unencrypted) GU_oidc_auth_state cookie

  guardian/gateway#3386 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: No server-side email format validation for prepopulateEmail query parameter

  guardian/gateway#3385 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: Hardcoded AES-256 encryption key committed in playwright-mocked.env

  guardian/gateway#3384 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: SSRF via unvalidated X-GU-Okta-Env request header in DEV stage

  guardian/gateway#3383 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: Unsanitised user-supplied fromURI value written directly to server logs - log injection risk

  guardian/gateway#3382 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: CSP style-src uses unsafe-inline in all environments, enabling CSS injection attacks

  guardian/gateway#3381 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: URL path parameters not encoded in buildUrl - potential path traversal in IDAPI requests

  guardian/gateway#3380 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026
  2

• Security: XSS via unescaped Okta API values in dev route HTML template

  guardian/gateway#3379 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: /unsubscribe-all POST endpoint is exempt from CSRF protection with no authentication

  guardian/gateway#3378 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: RUNNING_IN_PLAYWRIGHT env var disables cookie signing, token verification, and rate limiting if set in production

  guardian/gateway#3377 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: trust proxy: true allows IP spoofing via X-Forwarded-For, bypassing rate limiting

  guardian/gateway#3376 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: reCAPTCHA token not URL-encoded before use - HTTP Parameter Pollution possible

  guardian/gateway#3375 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026

• Security: CSP form-action directive is null - forms can submit to any origin

  guardian/gateway#3374 · Filter by author m75gyqbsrw-boop opened on Apr 22, 2026