AIKIDO-2026-21022

TL;DR

The driver verification code flow in DriverController::verifyCode mints a login token when the submitted code matches a stored VerificationCode or a fixed bypass value. Early versions accept a hardcoded 999000 code, and later versions compare the code against bypass_verification_code, which defaults to unset so a request that omits the code passes the null-sensitive check. Either path lets a caller authenticate as any driver identity without a valid code, across the public and internal driver routes. The fix routes both flows through a shared guard that requires a configured code, an allowlisted review identity, and a constant-time comparison.