I Found an Open Admin Endpoint in My Own Code
Written up in October 2026. Dates are when I actually built it. Reviewing your own code like you’re attacking it is humbling. I did that to my events collector and found a good one. The bug /admin/send-digest emails every subscriber, and it sat behind HTTP Basic Auth. The check was shaped like this: 1 2 if cfg.basic_auth_user: # verify the Authorization header against configured credentials Read that again. If BASIC_AUTH_USER isn’t set, the whole check is skipped, and the endpoint is open.
Read more →