Josh Kalderimis

Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token

Missing authorization in device and deployment group page events allows view-role members to change devices and deployment groups

Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old role

Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmware

Improper authentication lets Google sign-in and confirmation links sign users in to accounts registered with their email address by someone else

Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmware