Skip to content
OpenAdvisories

Vendor

mayswind

3 known vulnerabilities.

Products

ezbookkeeping 3
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-86041

    ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

    ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forwarded-For value. An…

    mayswind ezbookkeeping github.com/mayswind/ezbookkeeping Go
  • Medium 5.4
    CVE-2026-105131

    mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint

    ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchan…

    mayswind ezbookkeeping
  • Medium 6.8
    CVE-2026-94112

    mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

    mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple autho…

    mayswind ezbookkeeping