Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Version	Supported
5.x.y	✅
4.x.y	✅
< 4.0.0	❌

Reporting a Vulnerability

Please report (suspected) security vulnerabilities to vantage6@iknl.nl. You will receive a response from us within 72 hours. If the issue is confirmed, we will release a patch as soon as possible. When the patched is released you will be informed.

Algorithm developer can edit another developer's algorithm that is pending / under review
GHSA-47w6-gwp4-w6vc published Jul 23, 2026 by bartvanb

Moderate
Vantage6 Server JWT secret not cryptographically secure
GHSA-m3mq-f375-5vgh published Jun 12, 2025 by bartvanb

Low
Lack of brute-force protection on change password functionality
GHSA-j6g5-p62x-58hw published Jun 12, 2025 by bartvanb

Low
Collaboration admins can extend their influence by expanding the collaboration
GHSA-99r4-cjp4-3hmx published May 22, 2024 by bartvanb

Low
2FA can be circumvented with hacked email access
GHSA-4c5c-2vc3-x5w2 published Jun 5, 2026 by bartvanb

Low
Set admin user and password from environment or configuration
GHSA-fgmc-2hqj-86v4 published Jun 5, 2026 by bartvanb

Moderate
Username enumeration attack on recover password/recover MFA token
GHSA-5h3x-6gwf-73jm published Mar 14, 2024 by bartvanb

Low
No limit on emails sent for MFA reset
GHSA-5549-c5q7-fj65 published Jun 5, 2026 by bartvanb

Low
CORS settings overly permissive
GHSA-4946-85pr-fvxh published Mar 14, 2024 by bartvanb

Low
Unencrypted task can be created in encrypted collaboration
GHSA-rjmv-52mp-gjrr published Jan 30, 2024 by bartvanb

Low

Learn more about advisories related to vantage6/vantage6 in the GitHub Advisory Database