--- title: "Vulnerability disclosures" description: "Vulnerabilities François Martin found and reported through coordinated disclosure, each linked to its public CVE record or security advisory, with the affected projects' public usage figures." canonical_url: "https://fmartin.ch/vulnerabilities" last_updated: "2026-10-06" --- # Vulnerability disclosures Vulnerabilities I found and reported to the maintainers or vendor, each with its public record. This page lists only the ones that became public; I reported more privately. I reported each of these privately to the affected project or vendor first, following coordinated disclosure. The details became public only after a fix was released or, where the vendor did not respond, after the disclosure period ended. ## In numbers - 4 public disclosures since 2018 - Severity: 2 High, 2 Medium - 4B+ downloads a year of Logback and SLF4J together. Source: [QOS.ch](https://github.com/sponsors/qos-ch) - 12.6M npm downloads of Better Auth in one week. Source: [npm download counts](https://api.npmjs.org/downloads/point/last-week/better-auth) - 21M+ downloads of VeryFitPro, Android alone. Source: [AppBrain](https://www.appbrain.com/app/veryfitpro/com.veryfit2hr.second) Public usage figures, read on October 5, 2026. ## CVE-2026-104721, Logback Classic An attacker could make an application write to any reachable file it had permission to change, including files outside its log directory. The attacker could replace Logback's active configuration, expose future logs, disable or falsify audit records, redirect logs, and create, overwrite, or truncate other writable files. Some applications use Logback to create separate log files for different users, customers, or requests. If the application copied attacker-controlled data into the value used for the file name, an attacker could use a variable that became a slash after Logback checked it and escape the intended directory. Replacing the logging configuration also required automatic reloading, overwrite mode, control of the logged message, and a path that could reach the configuration file. - Weaknesses: - [CWE-22: Path Traversal](https://cwe.mitre.org/data/definitions/22.html) - Affected 0.9.14 to 1.6.4 · Fixed [1.6.5](https://logback.qos.ch/news.html#1.6.5) - Medium severity: [CVSS 4.0 base score 6.3, assigned by NCSC.ch, the assigning CNA](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:N/RE:M/U:Green) - My part: Found, Reported - Published on October 2, 2026 - Links: [CVE record](https://www.cve.org/cverecord?id=CVE-2026-104721), [logback 1.6.5 release note](https://logback.qos.ch/news.html#1.6.5) ## GHSA-r4xp-prcw-77qf, Better Auth An attacker who knew only a user's verified email address could sign in as that user without knowing their password or requiring any action from the victim. The attacker could access private data, change the account, and add another sign-in method. This affected applications using the OAuth Proxy plugin with sign-in data stored in cookies. By default, the plugin protected profiles with the application's main Better Auth secret, which also protected the sign-in data. An attacker could make Better Auth encrypt a forged profile and then accept it as real. Another demonstrated variant worked without the victim's email if the attacker knew an existing provider account identifier. - Weaknesses: - [CWE-287: Improper Authentication](https://cwe.mitre.org/data/definitions/287.html) - [CWE-345: Insufficient Verification of Data Authenticity](https://cwe.mitre.org/data/definitions/345.html) - Affected 1.5.0-beta.12 to 1.7.6 · Fixed [1.7.7](https://github.com/better-auth/better-auth/releases/tag/v1.7.7) - High severity: [CVSS 3.1 base score 7.4, assigned by the Better Auth maintainers](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) - My part: Found, Reported - Published on September 30, 2026 - Links: [GitHub advisory](https://github.com/better-auth/better-auth/security/advisories/GHSA-r4xp-prcw-77qf), [Fix pull request](https://github.com/better-auth/better-auth/pull/11494) ## CVE-2021-36460, VeryFitPro Anyone who obtained a user's password hash could take over the account without knowing the password. The app hashes the password on the device with SHA-1 and sends that hash as the credential for login, registration and password changes, so the hash the server stores works like the password itself. - Weaknesses: - [CWE-836: Use of Password Hash Instead of Password for Authentication](https://cwe.mitre.org/data/definitions/836.html) - Affected 3.3.7 and earlier (Android, iOS) · Fixed: no fix - High severity: [CVSS 3.1 base score 7.8, assigned by NVD](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - My part: Found, Reported - Reported on June 25, 2021 - Published on April 25, 2022 - Closed-source product - Links: [NVD record](https://nvd.nist.gov/vuln/detail/CVE-2021-36460), [Write-up](https://github.com/martinfrancois/CVE-2021-36460) ## CVE-2018-1000529, Grails Fields plugin An attacker who could store a value in a Grails application could run script in the browser of anyone who viewed that value. The plugin's display tag rendered bean property values without HTML encoding. Grails scaffolding uses the plugin, so scaffolded applications were affected. - Weaknesses: - [CWE-79: Cross-site Scripting (stored)](https://cwe.mitre.org/data/definitions/79.html) - Affected 2.2.7 and earlier · Fixed [2.2.8](https://github.com/grails-fields-plugin/grails-fields/commit/a67c96219b3dd31f61a1c0b595a7439e63eee277) - Medium severity: [CVSS 3.0 base score 6.1, assigned by NVD](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) - My part: Found, Reported - Reported on May 22, 2018 - Published on June 26, 2018 - Links: [NVD record](https://nvd.nist.gov/vuln/detail/CVE-2018-1000529), [Write-up](https://github.com/martinfrancois/CVE-2018-1000529) ## Sitemap See the [Markdown sitemap](https://fmartin.ch/sitemap.md) for every page, or [sitemap.xml](https://fmartin.ch/sitemap.xml) for the XML index.