Logged In Is Not Allowed In
From Evidence, Or It Doesn't Count · 00:16:09
Show by Levinitycyber
Three real vulnerabilities. Three completely different programs, built by three different teams. One identical mistake: they confused being logged in with being allowed.Every app has to ask two questions before it lets you do something. Who are you, and is this thing actually yours. The first is authentication, and everyone pours money into it. The second is authorization, and half of them forget to ask it once you are past the login screen. That gap is where an enormous share of real breaches actually live, and this episode walks three published, fixed, credited findings that all fell into it.The main case is W Y G I W Y H, a self-hosted personal finance app. Its main rule editor correctly checked ownership before letting you change a rule, but four sibling endpoints that toggled, added, edited, and deleted the same rule skipped that check entirely, so any logged-in user could quietly rewrite how someone else's money was sorted and routed. Then a security tool called mobileAudit, software built specifically to find flaws, which shipped the same class of bug and let any account reach into another user's scan findings. And a WordPress plugin called Directorist, where a low-privilege subscriber could forge a paid order and a payment record on a site that charges real money.The lesson is the thread: bugs travel in families. The security of a feature is not its best-protected door, it is its worst one. We close with three fixes you can apply this week: check ownership at the record and not at the gate, audit every sibling endpoint that touches the same data, and write the adversary test where one user tries to touch another user's things. That single test would have caught all three.All three findings were reported responsibly, fixed by their maintainers, and credited to LevinityCyber.Chapters00:00 Cold open2:09 Authentication vs authorization5:10 Bugs travel in families7:28 The security tool that had the bug9:44 Forging a payment12:03 The fixes14:08 One mistake, three teamsLinksResearch and disclosures: https://levinitycyber.com/researchWYGIWYH transaction-rule BOLA: GHSA-83g9-vjqf-2j5q (High 7.1, fixed 0.23.1), credited LevinityCybermobileAudit cross-user BOLA: GHSA-7hxj-q4hw-v9x6 (Moderate), fixed, credited LevinityCyberDirectorist paid-order forgery: CVE-2026-84027 (Medium), credited LevinityCyberEvidence, or it doesn't count. Real bugs. Real vendors. Public receipts. Hosted by Moshe Levi, LevinityCyber.Chapters are the real timestamps from the 16:09 cut.
More episodes of Evidence, Or It Doesn't Count
More episodes
- The One We Vouched For
- The Robots Started Trusting Each Other
- The Memory That Belonged to Someone Else
- Who Told the Robot It Could Do That
- The Tool on Someone Else's Computer
- The Chatbot That Gave Away
- The Wall Between Us
- The Doors That Never Locked
- AI vs. IBM: Let the Rumble Begin
- The Fix That Wasn't: The Bug Hiding Inside a Patch
podsearch is a free, independent podcast search engine. Read about podsearch, the privacy policy or contact us.