Could someone explain this? Does this mean that it enables logging in as any account in emudhras infra?
Yes, it’s a complete auth bypass. All you need is the email address of a user and they’ll likely sign CSRs for any domains under that account.
It’s the end for them, I imagine.
alt Hacker News
Yes, it’s a complete auth bypass. All you need is the email address of a user and they’ll likely sign CSRs for any domains under that account.
It’s the end for them, I imagine.