getmaxun maxun CVE-2025-15106

Upgrade to a patched version newer than 0.0.28 once released by the getmaxun project. The vendor did not respond to early disclosure, so patch availability should be verified at the official getmaxun repository (likely GitHub). In the interim, implement compensating controls: (1) Conduct an authorization audit of all endpoints in server/src/routes/auth.ts to identify which resources are accessible by low-privilege users and whether that access is intentional - this may reveal scope of the bypass; (2) Apply network segmentation to restrict unauthenticated users from reaching the application if feasible, though this has limited effectiveness since the attacker must authenticate; (3) Monitor authentication logs and access patterns for anomalous privilege escalation or unauthorized resource access attempts; (4) Implement API gateway rules to enforce role-based access control (RBAC) at the network layer as defense-in-depth, but note this does not fix the underlying application flaw. Reference: Exploit details and vulnerability details available at https://gist.github.com/H2u8s/1a0bdb19d5c8c8f4dc72cb49ffe9a22b and https://vuldb.com/?id.338477.