AIKIDO-2026-416696
otto is vulnerable to Improper Access Control
65
Medium Risk
This Affects:
ottoTL;DR
Otto builds its Rack application once during Otto.new and does not rebuild it when security middleware is later registered through the otto.security.* Configurator. Security controls such as CSRF protection, request validation, rate limiting, and CSP reporting that are configured after initialization are added to the middleware stack but never execute on the request chain. Unsafe requests that should be rejected are accepted and the other configured protections silently do not run, while the application appears to be protected. The fix wires a middleware-stack change callback so the Rack app is rebuilt whenever middleware is registered, ensuring the configured controls are enforced.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and register security middleware through the otto.security.* Configurator after Otto.new.
Background info
otto is vulnerable to Improper Access Control in versions 2.0.0 - 2.3.1.
How to fix this
Upgrade the otto library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant