Issues

Issues

• [Security] Faucet per-IP rate limit bypassed via spoofable CF-Connecting-IP / X-Forwarded-For headers

  thirdweb-dev/js#9064 · opened on Nov 8, 2026
  1

• [Security] Unauthenticated cache-revalidation server actions allow arbitrary cache purge

  thirdweb-dev/js#9063 · opened on Nov 8, 2026
  1

• [Security] /api/auth/ensure-login returns JWT in JSON body without Cache-Control: no-store

  thirdweb-dev/js#9062 · opened on Nov 8, 2026
  1

• [Security] Open redirect and reverse tabnabbing via redirectUri parameter on /pay/[id]

  thirdweb-dev/js#9061 · opened on Nov 8, 2026
  1

• [Security] Bridge webhook HMAC verification: NaN timestamp bypasses freshness check, non-constant-time signature compare

  thirdweb-dev/js#9060 · opened on Nov 8, 2026
  1

• [Security] IDOR: /join/team/[slug]/[invite_id] serializes full Team object to any onboarded user

  thirdweb-dev/js#9059 · opened on Nov 8, 2026
  1

• [High] Stripe server action authorization bypass (CWE-862, CWE-639)

  thirdweb-dev/js#9058 · opened on Nov 8, 2026
  1

• x402: async hook before signing in wrapFetchWithPayment

  thirdweb-dev/js#9055 · opened on Nov 6, 2026
  1

• [SDK] checkVerificationStatus sends the API key with a trailing double quote

  thirdweb-dev/js#9049 · opened on Nov 2, 2026
  2

• [SDK] x402 payment retry reuses a consumed Request body

  thirdweb-dev/js#9046 · opened on Nov 2, 2026
  2

• [SDK] x402 payment retry drops HeadersInit and Request-owned headers

  thirdweb-dev/js#9045 · opened on Nov 2, 2026
  2