New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

INSECURE: Lobby2 extension stores passwords in cleartext #59

Open

jompu opened this issue Dec 15, 2019 · 0 comments

jompu commented Dec 15, 2019 •

edited

Loading

You should fix the lobby2 extension or deprecate it as insecure.

It stores the passwords in cleartext and sends a lost password in cleartext to users email.

You can verify this by just looking into DependentExtensions/Lobby2/PGSQL/Lobby2Message_PGSQL.cpp file and search for a password string.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment