[security] Add credits for CVE-2022-0639

unshiftio · Feb 17, 2022 · 4f2ae67 · 4f2ae67
1 parent 8b3f5f2
commit 4f2ae67
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/SECURITY.md b/SECURITY.md
@@ -33,6 +33,18 @@ acknowledge your responsible disclosure, if you wish.
 
 ## History
 
+> A specially crafted URL with empty userinfo and no host can be used to bypass
+> authorization checks.
+
+- **Reporter credits**
+  - Haxatron
+  - GitHub: [@haxatron](https://github.com/haxatron)
+  - Twitter: [@haxatron1](https://twitter.com/haxatron1)
+- Huntr report: https://www.huntr.dev/bounties/83a6bc9a-b542-4a38-82cd-d995a1481155/
+- Fixed in: 1.5.7
+
+---
+
 > Incorrect handling of username and password can lead to authorization bypass.
 
 - **Reporter credits**