GET /admin/api/settings requires X-Admin-Key (401 without). Ten rapid guesses with different keys all returned 401 with no 429, delay, or lockout - unlike paste creation which rate limits at ~1/s.
Also, password unlock latency for pastes is ~3ms flat (no bcrypt/argon2 timing), suggesting password hashes may be stored with a fast hash or plaintext; combined with unthrottled admin attempts, online brute force is practical.
Repro: for i in 1..10: curl -H "X-Admin-Key: wrong$i" /admin/api/settings -> all 401, no throttling.
`GET /admin/api/settings` requires `X-Admin-Key` (401 without). Ten rapid guesses with different keys all returned 401 with no 429, delay, or lockout - unlike paste creation which rate limits at ~1/s.
Also, password unlock latency for pastes is ~3ms flat (no bcrypt/argon2 timing), suggesting password hashes may be stored with a fast hash or plaintext; combined with unthrottled admin attempts, online brute force is practical.
Repro: `for i in 1..10: curl -H "X-Admin-Key: wrong$i" /admin/api/settings` -> all 401, no throttling.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
GET /admin/api/settingsrequiresX-Admin-Key(401 without). Ten rapid guesses with different keys all returned 401 with no 429, delay, or lockout - unlike paste creation which rate limits at ~1/s.Also, password unlock latency for pastes is ~3ms flat (no bcrypt/argon2 timing), suggesting password hashes may be stored with a fast hash or plaintext; combined with unthrottled admin attempts, online brute force is practical.
Repro:
for i in 1..10: curl -H "X-Admin-Key: wrong$i" /admin/api/settings-> all 401, no throttling.