AIKIDO-2026-10411

TL;DR

In the cookie JWT extraction path in extractJWT.ts, when the Origin header is absent the server accepts the auth cookie, so cross-site requests can authenticate as the user. The fix validates Sec-Fetch-Site when Origin is missing and rejects cookies for cross-site and none requests when CSRF is configured. Separately, forgot-password and verification email URLs were built from the request Host header without validation, allowing a forged Host to point users to an attacker-controlled origin; the fix uses getRequestOrigin so origin is taken from serverURL or validated against the CORS/CSRF allowlist. Additional hardening in this release includes stricter path and input validation (e.g. sanitizePathSegment, sanitizeUrl, and validation of query paths and upload URLs) to reduce injection and path traversal risk.