Rotimi Best 25d1a8d710 Security Release v0.2.6: Email Verification Bypass Vulnerabilities Fixed ...

Critical security fixes addressing email verification bypass vulnerabilities:

Security Issues Fixed:
- Email verification status manipulation through client-side profile updates
- Base64 token forgery allowing arbitrary email verification
- DOM manipulation bypasses of email verification modal

Backend Security Enhancements:
- Secure verification tokens table with cryptographic token generation
- RLS policies preventing direct email verification status changes
- Server-side validation functions with expiration and ownership checks
- Database triggers blocking unauthorized verification status updates
- IP address logging and audit trails for security monitoring

Frontend Security Protections:
- Multi-layered DOM protection preventing UI manipulation bypasses
- Continuous monitoring and re-application of interaction restrictions
- CSS-based backup protection even if JavaScript is disabled
- Mutation observer to protect dynamically added elements
- Enhanced CSP configuration for Senja widget support

API Security Updates:
- Secure token-based verification replacing insecure Base64 method
- Comprehensive error handling with security-focused user messages
- Token validation with signature verification and expiration checks
- Legacy verification method blocking with security warnings
- Enhanced verification email generation with secure tokens

Files Modified:
- Database: New email_verification_tokens table and security functions
- API: Secure verification endpoints with token validation
- Frontend: DOM protection and verification modal enhancements
- CSP: Updated Content Security Policy configuration
- Blog: Security advisory for CVE-2025-65675 disclosure

This release patches critical authentication bypass vulnerabilities and
implements defense-in-depth security measures across the entire platform.

Security researchers and users should upgrade immediately.

2025-12-03 15:33:04 +01:00

..

routes

feat: 🚀 😃 convert repo into a monorepo 🚀 😃 (#51)

2023-11-25 21:56:02 +00:00

tinymce

feat: end to end api type safety with redis rate limiting (#573)

2025-09-21 19:35:41 +01:00

api.js

feat: 🚀 😃 convert repo into a monorepo 🚀 😃 (#51)

2023-11-25 21:56:02 +00:00

app.js

feat: 🚀 😃 convert repo into a monorepo 🚀 😃 (#51)

2023-11-25 21:56:02 +00:00

appSetup.ts

Security Release v0.2.6: Email Verification Bypass Vulnerabilities Fixed

2025-12-03 15:33:04 +01:00

course.spec.ts

feat: unit tests for utils (#92)

2023-12-20 14:28:40 +03:00

course.ts

fix: course and org landing page improvements (#468)

2024-09-09 01:14:55 +01:00

date.spec.ts

feat: unit tests for utils (#92)

2023-12-20 14:28:40 +03:00

date.ts

feat: org and course student analytics page (#509)

2024-12-30 02:59:10 +01:00

domain.ts

fix: validate domain isn't classroomio

2024-11-14 20:48:47 +01:00

fileValidation.ts

fix: critical SVG XSS vulnerability in file uploads

2025-12-03 11:25:00 +01:00

formatDate.js

feat: 🚀 😃 convert repo into a monorepo 🚀 😃 (#51)

2023-11-25 21:56:02 +00:00

formatYoutubeVideo.spec.ts

feat: unit tests for utils (#92)

2023-12-20 14:28:40 +03:00

formatYoutubeVideo.ts

chore: move backend to hono + typescript (#558)

2025-06-09 01:38:57 +01:00

generateSlug.js

feat: 🚀 😃 convert repo into a monorepo 🚀 😃 (#51)

2023-11-25 21:56:02 +00:00

generateSlug.spec.js

feat: unit tests for utils (#92)

2023-12-20 14:28:40 +03:00

generateUUID.spec.ts

feat: unit tests for utils (#92)

2023-12-20 14:28:40 +03:00

generateUUID.ts

feat: 🚀 😃 convert repo into a monorepo 🚀 😃 (#51)

2023-11-25 21:56:02 +00:00

genUniqueId.js

feat: 🚀 😃 convert repo into a monorepo 🚀 😃 (#51)

2023-11-25 21:56:02 +00:00

genUniqueId.spec.js

feat: unit tests for utils (#92)

2023-12-20 14:28:40 +03:00

getCurrencyFormatter.spec.ts

feat: unit tests for utils (#92)

2023-12-20 14:28:40 +03:00

getCurrencyFormatter.ts

feat: 🚀 😃 convert repo into a monorepo 🚀 😃 (#51)

2023-11-25 21:56:02 +00:00

isObject.spec.ts

feat: unit tests for utils (#92)

2023-12-20 14:28:40 +03:00

isObject.ts

feat: unit tests for utils (#92)

2023-12-20 14:28:40 +03:00

isSubmissionEarly.js

feat: 🚀 😃 convert repo into a monorepo 🚀 😃 (#51)

2023-11-25 21:56:02 +00:00

IsSubmissionEarly.spec.js

feat: unit tests for utils (#92)

2023-12-20 14:28:40 +03:00

isUUID.ts

feat: 🚀 😃 convert repo into a monorepo 🚀 😃 (#51)

2023-11-25 21:56:02 +00:00

logout.ts

fix: keep org store after logout

2025-11-08 17:58:03 +01:00

number.ts

feat: implement percentage calculation utility and refactor analytics to use it

2025-09-18 10:34:54 +01:00

org.spec.ts

feat: unit tests for utils (#92)

2023-12-20 14:28:40 +03:00

org.ts

feat: dashboard billing (#193)

2024-04-07 06:08:34 +01:00

removeDuplicate.js

feat: 🚀 😃 convert repo into a monorepo 🚀 😃 (#51)

2023-11-25 21:56:02 +00:00

removeDuplicate.spec.js

feat: unit tests for utils (#92)

2023-12-20 14:28:40 +03:00

sanitize.ts

fix: critical SVG XSS vulnerability in file uploads

2025-12-03 11:25:00 +01:00

showAppsSideBar.js

fix: replace button not working on landing page editor (#141)

2024-01-28 22:15:15 +01:00

showAppsSideBar.spec.js

feat: unit tests for utils (#92)

2023-12-20 14:28:40 +03:00

string.spec.ts

feat: unit tests for utils (#92)

2023-12-20 14:28:40 +03:00

string.ts

feat: 🚀 😃 convert repo into a monorepo 🚀 😃 (#51)

2023-11-25 21:56:02 +00:00

supabase.server.ts

docker improvements + delete unused package

2025-05-03 14:46:01 +01:00

supabase.ts

chore: use hasSession to check if auth token exists

2025-11-08 17:30:22 +01:00

theme.ts

fix: theme undefined prevents settings page from loading

2024-10-15 01:46:05 +01:00

toHtml.ts

feat: course news feed (#136)

2024-02-28 03:00:31 +01:00

translations.ts

feat: add danish support to dashboard (#580)

2025-10-13 18:07:46 +01:00

trycatch.ts

feat: custom org brand color (#474)

2024-10-06 01:20:32 +01:00

user.ts

feat: 🚀 😃 convert repo into a monorepo 🚀 😃 (#51)

2023-11-25 21:56:02 +00:00

validateEmail.js

feat: 🚀 😃 convert repo into a monorepo 🚀 😃 (#51)

2023-11-25 21:56:02 +00:00

validateEmail.spec.js

feat: unit tests for utils (#92)

2023-12-20 14:28:40 +03:00

validator.ts

fix: onboarding validation error showing translation key #586 (#593)

2025-11-01 09:54:19 +01:00