SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Developer Finds Critical Auth Bypass in Spring Boot App Caused by Null Password Handling

0
·3 views

A developer building SCIP, a Spring Boot-based supply chain platform with over 90 REST endpoints, discovered a critical authentication bypass vulnerability during boundary testing. The flaw allowed any account with a null password field — such as soft-deleted users or malformed requests — to authenticate successfully with any password. The root cause was BCrypt's behavior when passed a null value, which returned true regardless of the stored hash. Standard happy-path test suites never caught the issue because they only validate correct credentials against valid hashes, not missing or null inputs. The fix was straightforward: adding a null guard to check the password field before BCrypt's comparison function is ever invoked.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Developer builds fully client-side image editor using browser-native AI and WebAssembly

A developer has created APIC-Web, a free browser-based image editor that performs background removal, object removal, filters, and format conversion entirely on the user's device, with no photo ever uploaded to a server. The tool leverages MediaPipe's on-device ML model, WebAssembly, and the HTML Canvas API to keep all processing local. For cleaner background removal, the editor uses confidence masks returning float probabilities per pixel rather than hard binary labels, enabling smoother edge feathering around fine details like hair. Object removal is handled through exemplar-based texture synthesis — a pre-generative-AI technique — since running diffusion models client-side without server infrastructure is not feasible. The project is publicly available as a static web page, and the developer has shared key technical lessons around mask handling and performance optimization for others building similar privacy-focused tools.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Build a Reliable Multilingual Chat Translation Workflow with Tencent RTC

A tutorial published on DEV Community walks developers through building a production-grade translation workflow for community chat applications using Tencent RTC's TUIChat SDK. The guide highlights that while a translate button may appear simple to implement, real-world scenarios demand handling edge cases such as deleted messages, failed translations, and disputed meanings. The proposed architecture separates pure decision logic from imperative operations like API calls and persistence, using an event-driven pipeline to manage state safely. Key design rules ensure translation requests are recorded before execution, failed attempts keep original text visible, and human corrections are labeled rather than overwriting machine output. The tutorial also enforces that translation and content moderation remain independent processes to prevent policy bypass.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Incident Agent Reported 'Healthy' Pipeline Using Stale Cached Data, Not Live Checks

A developer building Pipeline Rescue Agent, a Next.js incident-investigation tool, discovered a logic bug where the app reported a pipeline as 'Healthy' even when live Fivetran telemetry was unavailable. When the live data fetch failed, the app silently fell back to cached connector status showing 'connected' and 'on_schedule,' and used that stale snapshot to issue a current health verdict. No exception was raised and the API request completed successfully, making the false 'Healthy' verdict invisible without inspecting the evidence source alongside the final decision. The flaw mattered beyond display: the health verdict directly influenced which issues the agent prioritized for further investigation, meaning a false green could cause real problems to go unexamined. The fix involved ensuring that cached, non-live evidence could no longer satisfy a present-tense health determination, and Sentry instrumentation was used to reproduce, diagnose, and verify the correction across deliberate repository states.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Dev Builds Tool to Use Claude Subscriptions in Pi Agent, Warns of Account Risk

A developer has released an open-source extension called pi-sub-anthropic that allows the minimalist Pi coding agent to authenticate using a Claude Pro or Max subscription instead of a paid API key. Since April 4, 2026, Anthropic has enforced a server-side policy blocking third-party tools from using subscription OAuth tokens, returning billing errors for such attempts. To bypass this, the extension replicates Claude Code's network fingerprint, effectively presenting itself as Anthropic's own first-party client. The developer openly warns this may violate Anthropic's usage policies and that accounts could be suspended or terminated without notice. As a safer alternative, the tool also supports standard API key authentication, which the author explicitly recommends over the subscription workaround.

0 comments Read more at DEV Community