TSI DPDP-CMS Client-Side Auth Bypass: Unauthenticated Access to Admin/DPO Console

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Name: TSI-DPDP-CMS-Client-Side-Only-Authentication-Allows-Complete-Bypass-via-Direct-HTTP-Request Primary Category: Client-Enforced Server-Side Security (CWE-602) Secondary Category: Missing Authentication of Critical Function (CWE-306) Severity: Medium (Information Disclosure, Non-Critical) Reporter: VuDB, received 2026-08-24 Scope of Impact All 17 admin and DPO console pages ( , ) return 200 to any HTTP request, without any server-side authentication check. The only authentication gate is client-side JavaScript: This check executes in the browser after the page has already been delivered. Any client that does not execute JavaScript (curl, wget, Python requests, Burp Suite, etc.) can access these pages unauthenticated, including internal API endpoint paths, the dispatch table, query parameter table, and the admin/DPO role routing logic. Root Cause: The (the only non-automatically enforced server-side filter) is mapped to in . Any request path prefix—including each static console page—bypasses it, falling back to default static file serving. Severity Correction: The original report described it as a "complete bypass" allowing unauthenticated access to admin/DPO functionality. In reality, each API call on the console pages ( , ) is enforced by independent server-side authentication, where / runs on every request, regardless of whether the client-side page check passed. There is no ROP, breach, grellence, or user data, and no operation is accessible unauthenticated through this issue. The actual impact is the disclosure of the client-side application source code (endpoint lists, names, request patterns)—classified as Medium – Information Disclosure, Non-Critical. Remediation Added: Server-side authentication for the (unauthenticated) API: - ( ): A server-side filter mapped to and in that intercepts requests and verifies that a valid, non-expired operator session exists (validated via the existing ) before dispatching any static file; otherwise, it redirects to to display the login page. - Session Cookie: Since flat browser navigation to a URL cannot carry a custom header (only /XHR can), a small httpOnly, SameSite=strict, Secure Cookie ( , scoped to ) is set upon login and cleared upon logout. - ( ): Because the project's Servlet 5.0 API predefines , the header is used to set , matching the local TLS conversion of to . - : Clears the Cookie and sends the extended login response; clears it and invokes the existing JWT block revocation. Result: Unauthenticated requests (curl, without session Cookie) to any of the 17 console pages now receive a redirect to instead of the page content. Modified Files (new)

Goal Reached Thanks to every supporter — we hit 100%!

TSI DPDP-CMS Client-Side Auth Bypass: Unauthenticated Access to Admin/DPO Console

More from this source