CVE-2026-71214

Popis

The Aerie/PlanDev sequencing-server-s authorization middleware (sequencing-server/src/app.ts) derives the caller-s Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header-s JWT claims, with no verification that the request actually originated from Hasura.