Description
The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a JavaScript file loaded on the client side, thus rendering this extra safety mechanism useless.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Resort Data Processing | IRM Next Generation | — | — |