AIKIDO-2026-324914

TL;DR

The processAuthBridgeMessage handler in the nested app authentication bridge guards message processing with an origin check, but it evaluates the asynchronous shouldProcessIncomingMessage function by negating its returned promise instead of awaiting the resolved boolean. Because a promise object is always truthy, the if (!...) guard never rejects, so the handler processes nested app auth bridge messages regardless of whether the origin is in the allowlist or the message comes from the same window. An attacker able to post a crafted message to the app window can have forged authentication bridge responses processed, defeating origin validation. The fix awaits verifyIncomingMessageOrigin and continues only when it resolves to true, otherwise the message is ignored.