[BUG] Bot secret is unsecure #49

New issue

Open

opened 2026-08-03 17:51:54 +00:00 by PoweredDeveloper · 0 comments

PoweredDeveloper commented

2026-08-03 17:51:54 +00:00

Owner

Describe the bug
Single static shared secret guards everything — all routers depend on verify_bot_secret (auth/dependencies.py:42-53), including user management, admin package CRUD, and token issuance. It's:

compared with != (timing-attackable),
has a hardcoded weak default "envelope6767" (backend/src/config.py:65) — if env var is missing, production runs with a known secret, leaks ⇒ attacker gets admin role, free balance, and can impersonate any user via /auth/telegram (which accepts an arbitrary telegram_id with zero verification). Make backend fail on unsetted env

Checklist

I have searched for existing issues (including closed ones)
I can reproduce the issue on a fresh installation or latest version

**Describe the bug** Single static shared secret guards everything — all routers depend on verify_bot_secret (auth/dependencies.py:42-53), including user management, admin package CRUD, and token issuance. It's: - compared with != (timing-attackable), - has a hardcoded weak default "envelope6767" (backend/src/config.py:65) — if env var is missing, production runs with a known secret, leaks ⇒ attacker gets admin role, free balance, and can impersonate any user via /auth/telegram (which accepts an arbitrary telegram_id with zero verification). Make backend fail on unsetted env **Checklist** - [x] I have searched for existing issues (including closed ones) - [ ] I can reproduce the issue on a fresh installation or latest version

PoweredDeveloper added this to the Sprint 1 milestone

2026-08-03 17:51:54 +00:00

PoweredDeveloper added the

backend

bug

security

labels

2026-08-03 17:51:54 +00:00