Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://infosec.exchange/users/avuko/statuses/116788556967579167">⠠⠵ avuko (avuko@infosec.exchange)'s status on Monday, 22-Jun-2026 00:32:16 JST</a><a href="https://infosec.exchange/@avuko" title="avuko@infosec.exchange"><img src="https://gnusocial.jp/avatar/27906-48-20250124060252.webp" width="48" height="48" alt="⠠⠵ avuko" style="position: absolute; left: 0; top: 0;">⠠⠵ avuko</a><div><ul><li></ul></div></section><article><p><a href="https://aseachange.com/@elena" rel="nofollow">@elena</a> <a href="https://mastodon.ar.al/@aral" rel="nofollow">@aral</a> I couldn't resist, so I've wasted my precious time looking at "W Identity" today.</p><p>Things are not right.</p><p>It is basically a repurposed <a href="https://github.com/PeterWaher/IoTGateway" rel="nofollow">https://github.com/PeterWaher/IoTGateway</a> </p><p>Just look here: <a href="https://root.widentity.eu/Settings/Master.md" rel="nofollow">https://root.widentity.eu/Settings/Master.md</a></p><p>It has a socks4(?) open on port 1080, some xmpp stuff on 5222 and 5269, another (seemingly broken) version of the website on 8088.</p><p>The following pages are accessible without auth: </p><p>(found by a simple "egrep -LR 'Privilege:|Login:' * |grep md | grep Root" through the source)</p>/Settings/PersonalData/LocalDatabase.md<br>/Settings/PersonalData/LocalSensorsAndDevices.md<br>/Settings/PersonalData/EventLogs.md<br>/Settings/PersonalData/NetworkIdentity.md<br>/Settings/PersonalData/WebPages.md<br>/Settings/PersonalData/Backups.md<br>/Settings/Master.md<br>/Copyright.md<br>/Starting.md [http response 307]<br>/Login.md<br>/Entities.md<br>/Templates/Repeat.md<br>/AdminDropdownComponent.md<br>/Script.md<br>/AdminDropdown.md<br>/AlertPopup.md<br>/Master.md<br>/PromptPopup.md<br>/ConfirmPopup.md<br>/Markdown.md<br>/Emojis.md<br>/Smileys.md<br>/Index.md<br>/MarkdownEditor.md<br>/ScriptColors.md<br>/Master.md<br><p>Others pages also exist (no 404), but are only available after login.</p><p>Which brings me to the biggest problem of all. </p><p>This is an ADMIN interface. </p><p>Nobody should ever put an admin interface to an identity management platform on the internet.</p><p><a href="https://infosec.exchange/tags/WSocial" rel="tag">#WSocial</a> <a href="https://infosec.exchange/tags/Widentity" rel="tag">#Widentity</a></p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/6494664#notice-12783164">In conversation</a><time datetime="2026-06-22T00:32:16+09:00" title="Monday, 22-Jun-2026 00:32:16 JST">about 4 months ago</time> <span>from <span><a href="https://infosec.exchange/@avuko/116788556967579167" rel="external" title="Sent from infosec.exchange via ActivityPub">infosec.exchange</a></span></span><a href="https://infosec.exchange/@avuko/116788556967579167">permalink</a><h4>Attachments</h4><ol><li><article><header><div>No result found on File_thumbnail lookup.</div><h5><a href="http://right.It/">right.it</a></h5><div></div></header><div>First Lady Suits</div><footer></footer></article></li><li><article><header><div>Domain not in remote thumbnail source whitelist: opengraph.githubassets.com</div><h5><a href="https://github.com/PeterWaher/IoTGateway">GitHub - PeterWaher/IoTGateway: New project</a></h5><div></div></header><div>New project. Contribute to PeterWaher/IoTGateway development by creating an account on GitHub.</div><footer></footer></article></li><li><label><a rel="external" href="https://gnusocial.jp/attachment/6192403">Untitled attachment</a></label><br><div>Invalid filename.</div></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
⠠⠵ avuko (avuko@infosec.exchange)'s status on Monday, 22-Jun-2026 00:32:16 JST⠠⠵ avuko
- Aral Balkan
@elena @aral I couldn't resist, so I've wasted my precious time looking at "W Identity" today.
Things are not right.
It is basically a repurposed https://github.com/PeterWaher/IoTGateway
Just look here: https://root.widentity.eu/Settings/Master.md
It has a socks4(?) open on port 1080, some xmpp stuff on 5222 and 5269, another (seemingly broken) version of the website on 8088.
The following pages are accessible without auth:
(found by a simple "egrep -LR 'Privilege:|Login:' * |grep md | grep Root" through the source)
/Settings/PersonalData/LocalDatabase.md
/Settings/PersonalData/LocalSensorsAndDevices.md
/Settings/PersonalData/EventLogs.md
/Settings/PersonalData/NetworkIdentity.md
/Settings/PersonalData/WebPages.md
/Settings/PersonalData/Backups.md
/Settings/Master.md
/Copyright.md
/Starting.md [http response 307]
/Login.md
/Entities.md
/Templates/Repeat.md
/AdminDropdownComponent.md
/Script.md
/AdminDropdown.md
/AlertPopup.md
/Master.md
/PromptPopup.md
/ConfirmPopup.md
/Markdown.md
/Emojis.md
/Smileys.md
/Index.md
/MarkdownEditor.md
/ScriptColors.md
/Master.md
Others pages also exist (no 404), but are only available after login.
Which brings me to the biggest problem of all.
This is an ADMIN interface.
Nobody should ever put an admin interface to an identity management platform on the internet.
#WSocial #Widentity
In conversationabout 4 months ago from infosec.exchangepermalink
Attachments
1. No result found on File_thumbnail lookup.
  right.it
  First Lady Suits
2. Domain not in remote thumbnail source whitelist: opengraph.githubassets.com
  GitHub - PeterWaher/IoTGateway: New project
  New project. Contribute to PeterWaher/IoTGateway development by creating an account on GitHub.
3. Untitled attachment
  Invalid filename.

Public

Embed Notice

HTML Code

Corresponding Notice