CVE-2022-31013

    Dashboard / Vulnerabilities / CVE-2022-31013

    CVE-2022-31013

    Published: 31 May 2022Last Modified: 12 Aug 2026

    Summary: Authentication bypass in Vartalap chat-server

    Details: Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validating the access token, resulting in authentication bypass. The function `this.authProvider.verifyAccessKey` is an async function, as the code is not using `await` to wait for the verification result. Every time the function responds back with success, along with an unhandled exception if the token is invalid. A patch is available in version 2.6.0.

    References: https://github.com/ramank775/chat-server/discussions/78, https://github.com/ramank775/chat-server/releases/tag/v2.6.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31013.json, https://github.com/ramank775/chat-server/security/advisories/GHSA-xx4j-qqpp-v277, https://nvd.nist.gov/vuln/detail/CVE-2022-31013

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- efe592001fc8032f45fbf8a08c2d444b3a7890af
    Fixed -b4cd6a5d0fe68f7b9cf655d487ec11d3830143d5

    Affected versions

    v2.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31013 | CVE-DB