Search results

[Security] Unauthenticated SSRF via Guardrail Webhook URL : No URL Validation, No Auth Required

Status: Open.

#535 In GenAI-Security-Project/finbot-ctf;

· prince-shakyaa opened on Jul 3, 2026

Adversarial coverage sweep: uncovered attack variants in two detectors

Status: Open.

#528 In GenAI-Security-Project/finbot-ctf;

· genesisadversary opened on Jun 9, 2026

[Bug] Guardrail webhook payload truncated mid-JSON before signing: body is unparseable but HMAC passes, and after_tool hook skipped for complete_task

Status: Open.

#525 In GenAI-Security-Project/finbot-ctf;

· prince-shakyaa opened on Jun 5, 2026

Fix Test Failures - Module Initialization and Schema Validation Errors

Status: Open.

#519 In GenAI-Security-Project/finbot-ctf;

· Jean-Regis-M opened on May 30, 2026

[Bug / Security] Dead Auth Guard in Challenge Check & Hint Endpoints: Anonymous Sessions Bypass Attempt Tracking and Hint Consumption

Status: Open.

#514 In GenAI-Security-Project/finbot-ctf;

· prince-shakyaa opened on May 28, 2026

[Bug / Security] CTF Sidecar Widget Endpoint Missing Authentication Enforcement: Anonymous Sessions Bypass Auth Guard

Status: Open.

#511 In GenAI-Security-Project/finbot-ctf;

· prince-shakyaa opened on May 23, 2026

[Bug] Profile Share-Card Cache Collision: Incomplete Cache Key Causes Stale Card Served After Avatar/Bio Change

Status: Open.

#508 In GenAI-Security-Project/finbot-ctf;

· prince-shakyaa opened on May 22, 2026

[Security] HTTPS Validation Bypass in User Profile Updates Leads to SSRF via Insecure Avatar URLs

Status: Open.

#506 In GenAI-Security-Project/finbot-ctf;

· prince-shakyaa opened on May 19, 2026

[Security] CSRF Token Exposed in JSON Response & Missing Content-Security-Policy Header

Status: Open.

#503 In GenAI-Security-Project/finbot-ctf;

· prince-shakyaa opened on May 18, 2026

[Security] Missing Input Validation, Rate Limiting, and Insecure DEBUG Default

Status: Open.

#501 In GenAI-Security-Project/finbot-ctf;

· prince-shakyaa opened on May 16, 2026

[Backend] Insecure defaults: SESSION_COOKIE_SECURE=False and ProxyHeadersMiddleware trusts all hosts

Status: Open.

#498 In GenAI-Security-Project/finbot-ctf;

· prince-shakyaa opened on May 15, 2026

[Bug]: Mobile Navigation Sidebar unresponsive in Admin and Dark Lab Portals

Status: Open.

#493 In GenAI-Security-Project/finbot-ctf;

· prince-shakyaa opened on May 8, 2026