[GH-ISSUE #37] Changing password should require a current password check #21

New issue

Closed

opened 2026-02-27 08:14:39 +03:00 by kerem · 1 comment

kerem commented

2026-02-27 08:14:39 +03:00

Owner

Originally created by @nitnelave on GitHub (Sep 16, 2021).
Original GitHub issue: https://github.com/lldap/lldap/issues/37

Currently that is achieved through the UI logic only, but anyone hitting the API can change their own password without verifying that they know the current one. It's probably okay for now, but it enables the following attach scenario:

User is logged in on a public/unattended computer OR an attacker gets hold of a currently valid auth token.
Attacker can use a purpose-built client to change the password of the victim.

To solve this, we can disallow the "register" opaque methods for any non-admin, and add a new endpoint to change the password that does both steps in parallel: establishing a new password while checking the old one. Both OPAQUE messages are sent for every step.

Originally created by @nitnelave on GitHub (Sep 16, 2021). Original GitHub issue: https://github.com/lldap/lldap/issues/37 Currently that is achieved through the UI logic only, but anyone hitting the API can change their own password without verifying that they know the current one. It's probably okay for now, but it enables the following attach scenario: User is logged in on a public/unattended computer OR an attacker gets hold of a currently valid auth token. Attacker can use a purpose-built client to change the password of the victim. To solve this, we can disallow the "register" opaque methods for any non-admin, and add a new endpoint to change the password that does both steps in parallel: establishing a new password while checking the old one. Both OPAQUE messages are sent for every step.

kerem

2026-02-27 08:14:39 +03:00

closed this issue
added the
bug

wontfix
labels

kerem commented

2026-02-27 08:14:40 +03:00

Author

Owner

@nitnelave commented on GitHub (Nov 20, 2021):

This is probably minor, and if we wanted to do it right it would complicate things when taking the password reset into account.

@nitnelave commented on GitHub (Nov 20, 2021): This is probably minor, and if we wanted to do it right it would complicate things when taking the password reset into account.

kerem referenced this issue

2026-02-27 08:17:45 +03:00

[PR #21] [MERGED] Add a docker image #495