getAlby / getAlby/lightning-browser-extension
[BUG] New passwords can be set repeatedly without verification of old passwords
- Dominant language
- TypeScript
- Stars
- 585
- Forks
- 228
- Avg merge
- 6d 7h
- Merged PRs (30d)
- 16
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Describe the bug
After creating the wallet, you can set a new password without the old password every time you open chrome-extension://iokeahhehimjnekafflcihljlcjccdbe/welcome.html. This is a serious vulnerability. When an existing wallet can be unlocked with a new password, Transferring assets is very serious
### Screenshots [optional]
_No response_
### Steps To Reproduce
1.open chrome-extension://iokeahhehimjnekafflcihljlcjccdbe/welcome.html
2.set new password
3.fuck...
### Expected behavior
1.open chrome-extension://iokeahhehimjnekafflcihljlcjccdbe/welcome.html
2.not allowed to set password
### Alby information
3.3.0_0
### Device information
_No response_
### Additional context
_No response_
### Are you working on this?
None
Contributor guide
Research direction
Reproduce the issue from the welcome.html page in the Chrome extension, then trace the password-setting flow and identify where an existing wallet is accepted without the old password. Done means a previously created wallet cannot have its password changed without verification of the old password, and the reported reproduction no longer succeeds.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100