Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, a Cross-Site Request Forgery (CSRF) in the login callback, allowed for session fixation. The turbo login command for self-hosted instances initiates a browser-based authentication flow. After the user authenticates, the provider redirects back to a local server running on 127.0.0.1. The vulnerability lies in the fact that this callback endpoint did not validate a CSRF token (commonly a state parameter). A malicious web page visited by the user could make a request to this known local endpoint (http://127.0.0.1:[port]) with an attacker-controlled authentication token. The turbo CLI, waiting for a token, would accept the first one it receives. If the attacker's request arrived first, the CLI would be logged in with the attacker's credentials, giving the attacker control over the user's remote cache for that session. The patch fixes this by implementing the standard state parameter CSRF protection mechanism. A unique, random state value is generated by the CLI and included in the initial authentication URL. This same state value is expected to be returned in the callback. The patched functions wait_for_login_redirect and wait_for_sso_redirect now enforce that the state parameter in the callback matches the one originally sent, rejecting any request with a missing or mismatched state.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| turbo | npm | <= 2.9.13 | 2.9.14 |
