Finding eight high-severity vulnerabilities in NodeBB in six hours

Published

2026-07-22 00:00

Collected

2026-07-22 15:48

---
id: 5073
title: "Finding eight high-severity vulnerabilities in NodeBB in six hours"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/eight-high-severity-vulnerabilities-nodebb"
published_at: "2026-07-22 00:00"
tags: ["ai-security", "featured", "vulnerability-research", "access-control", "activitypub", "nodebb", "xss", "template-injection", "ai-pentesting", "authorization-bypass"]
phying_url: "https://phying.com/item/5073"
lang: en
---

# Finding eight high-severity vulnerabilities in NodeBB in six hours

## Summary

Aikido’s AI-assisted white-box assessment found eight high-severity flaws in NodeBB in six hours, including multiple XSS and authorization-bypass issues across its ActivityPub implementation; fixes landed in NodeBB 4.14.0.

## Why it matters

Eight default-instance flaws found in six hours, including XSS and authorization bypasses, provide a concrete view of both AI-assisted audit speed and ActivityPub attack-surface risk.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-07-22 00:00
- **Original:** https://www.aikido.dev/blog/eight-high-severity-vulnerabilities-nodebb
- **Phying News:** https://phying.com/item/5073