AIKIDO-2026-10018

TL;DR

Affected versions of this package are vulnerable to Insufficient Session Validation, where sensitive actions like password changes and command execution can be performed by an authenticated user without validating the session's authority for sensitive actions, such as by prompting for password re-entry; this lack of validation allows attackers to exploit multiple broken access control vulnerabilities or local access to an unlocked device to perform unauthorized high-privilege actions.