Vulnerabilities

OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.

Malicious HTML content could be injected into the help texts of various fields with organizer permissions.

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users.

If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account.

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information.

A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.