AIKIDO-2025-10682

TL;DR

Affected versions of this package are vulnerable to authentication bypass due to an improper authorization check. The original code incorrectly set authRequired to false when ctx.body.userId was present, allowing API requests to potentially skip session validation by providing a user ID in the request body. An attacker could exploit this vulnerability by crafting requests with a malicious userId payload, thereby bypassing session checks and potentially gaining unauthorized access to other user accounts or performing privileged actions.