getAlby / getAlby/lightning-browser-extension

[BUG] New passwords can be set repeatedly without verification of old passwords

Open
#2,865 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
585
Forks
228
Avg merge
6d 7h
Merged PRs (30d)
16

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

After creating the wallet, you can set a new password without the old password every time you open chrome-extension://iokeahhehimjnekafflcihljlcjccdbe/welcome.html. This is a serious vulnerability. When an existing wallet can be unlocked with a new password, Transferring assets is very serious

### Screenshots [optional]

_No response_

### Steps To Reproduce

1.open chrome-extension://iokeahhehimjnekafflcihljlcjccdbe/welcome.html
2.set new password
3.fuck...

### Expected behavior

1.open chrome-extension://iokeahhehimjnekafflcihljlcjccdbe/welcome.html
2.not allowed to set password

### Alby information

3.3.0_0

### Device information

_No response_

### Additional context

_No response_

### Are you working on this?

None

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue from the welcome.html page in the Chrome extension, then trace the password-setting flow and identify where an existing wallet is accepted without the old password. Done means a previously created wallet cannot have its password changed without verification of the old password, and the reported reproduction no longer succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.