Written by
HCSV #004, titled "Authentication Endpoint Denial of Service and Redirect Validation", was a collection of security issues affecting the login flow, file uploads and related server-side request handling. The most serious finding was an unauthenticated process crash, allowing anyone to take a Hydraulisc instance offline with a single malformed login request. Further findings included an unvalidated post-login redirect, unauthenticated writes to disk, client-trusted upload types, session fixation, stale admin privileges, an invite code race condition and internal error disclosure.
This was a CRITICAL Security Vulnerability, which has been patched.
Login crash. The login endpoint assumed the username and password would always be text. If a request left one out, or sent it as a list of values instead of a single value, the server tried to process it anyway, hit an error it had no plan for, and the whole server process stopped. Nobody needed an account to do this, and one request was enough to take the instance offline for everyone. This kind of attack is called a Denial of Service.
Unchecked redirect. The login page accepts a ?next= parameter that says where to send you after you log in. Hydraulisc followed it without checking where it pointed, so a link like /login?next=https://evil.example would show the real Hydraulisc login page and then send the user to a fake site. This is called an open redirect.
Uploads saved before checking login. The upload, avatar and banner endpoints saved the file to disk first and only checked afterwards whether the sender was logged in. The request was rejected, but the file had already been written. Anyone could repeat this to fill up the server's storage.
Upload type taken on trust. When a file is uploaded, the sender's browser says what type of file it is, and that label is easy to fake. Hydraulisc only checked the label, so a file that was not an image could be stored by labelling it as one.
Session ID not renewed on login. Your session ID is the value in your cookie that tells the server who you are. Hydraulisc kept the same session ID from before login to after login. If an attacker could plant a session ID in someone's browser before they logged in, the attacker could reuse that same ID afterwards and be logged in as them. This is called session fixation.
Admin status remembered too long. Admin status was saved in the session at login and never checked again. If an admin was demoted, they kept admin access until their session expired, which could take up to 24 hours.
Invite codes could be used twice. Registering with an invite code took two separate steps: first check that the code exists and is unused, then mark it as used. If two people registered with the same code at the same moment, both could pass the check before either had marked it used, and both accounts were created. A bug that depends on the timing of two actions like this is called a race condition.
Internal errors shown to users. Some error messages included stack traces (the list of internal functions the server was running when it failed) and raw database errors. These show attackers how the server works inside.
Please note, the team at Hydraulisc-Centric Security Vulnerability have agreed that this Security Vulnerability is no longer reproducible.
The login endpoint now checks that both fields are present and are plain text before doing anything else, and returns an error message if they are not.
?next= must now be a path on Hydraulisc itself, such as /settings. Anything pointing to another website (https://…, //… or /\…) is ignored and the user goes to the home page.
The backend now checks all uploads are performed by users that are logged in before attempting to store anything.
Every image format starts with a fixed set of bytes, called its "magic bytes" or signature. The server now reads the start of each uploaded file and only keeps it if it really is a JPEG, PNG, GIF or WebP image, whatever label it was sent with. Files that fail the check are deleted.
nosniff and a sandbox Content Security Policy.These are two instructions sent along with each user-uploaded file. nosniff tells the browser not to guess the file type from its contents, and the sandbox policy tells it never to run anything inside the file. Even if a harmful file got through, the browser would not open it as a web page.
Logging in or registering now issues a brand new session ID and discards the old one, so an ID from before login is useless afterwards.
Every admin action now asks the database whether the user is still an admin, so removing admin rights takes effect immediately.
"Atomically" means in a single, indivisible step. The check and the "mark as used" now happen in one database command ("mark this code as used, but only if it is still unused"), and only the registration that actually changed the code is allowed through. There is no longer a gap between checking and marking for a second registration to slip into. Admins can also generate at most 100 invite codes per request.
A single error handler now catches every error. Users see a short, generic message, and the details are only written to the server's own logs.
helmet adds a standard set of protective instructions to every response, for example stopping other websites from embedding Hydraulisc pages in a hidden frame to trick users into clicking things (clickjacking).
These libraries handle uploads, form data and network requests. They were updated to versions that fix known security issues.
Guide: Severity Numbers: Lower is better. Maximum value of 20, lowest of 1.
| HCSV Code | HCSV #004 |
| Severity | 18 |
| Date uncovered | Oct. 24, 2026 |
| Date patched | Oct. 24, 2026 |
| Paper release | Oct. 25, 2026 |