Whistlelink: Site-access password exposed in web server access logs via GET query string

Vulnerability Overview Vulnerability Name: Whistlelink: Site-access password exposed in web server access logs via GET query string Severity: CRITICAL Description: Whistlelink is a website used to protect an opt-in, password-protected anonymous reporting platform. When a user unlocks such a site, the client verifies the password by sending an HTTP GET request containing the password. The password is present in the request line in Base64-encoded form and is recorded by the frontend web server's access logs. Since logs are typically centralized to network-accessible systems (such as log/observability platforms, offline backups, or object storage), anyone with access to these logs can easily decode the Base64 value and recover the plaintext site-access password, thereby compromising the access control of the entire protected reporting site. Impact Scope CVSS v3.1 Score: 7.7 (High) CVSS v3.1 Environment Score: 9.8 (Critical) CVSS v4.0 Score: High Impact: Site-access passwords are leaked to anyone with access to web server/proxy/aggregated logs or their backups. Potential for unauthorized access to protected sites. If site-access passwords are configured, attackers can bypass protection mechanisms. Long-term exposure: Log retention and backups mean secrets can still be recovered before password rotation. Remediation 1. Stop sending passwords in URLs: Use the POST method and send the password in the request body, ensuring TLS encryption and that it is not recorded in the request line. 2. Do not fix this issue: Ensure that password-based authentication is excluded from access/error logs and any observability/WAF captures; clean up historical logs and backups containing . 3. Do not rely on Base64 for confidentiality: Treat passwords as secrets and transmit them end-to-end; do not retain reversible copies in or Auth headers. 4. Rotate any site passwords that may have been logged: And reassess whether passwords have been compromised. 5. Server-side enforcement: Confirm that password gating is enforced on the server side at protected data endpoints, not just via client-side route guards. 6. Limit brute-forcing: Throttle requests and avoid simple boolean oracles to limit brute-force attacks. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Whistlelink: Site-access password exposed in web server access logs via GET query string

More from this source