Bostr Improper Authorization vulnerability

MEDIUM 6.3CVE-2024-41962 · GHSA-5cf7-cxrf-mq73 · Published 01/08/2024 · updated 17/06/2026

In short

CVE-2024-41962 is a MEDIUM (CVSS 6.3) vulnerability affecting bostr (yonle), bostr.
Chance of exploitation in the next 30 days (EPSS): 0.30%, higher than 22.6% of all vulnerabilities.
Fix: update to 3.0.10 or later.

Package	Affected versions	Patched versions
bostr yonle	`< 3.0.10`	`3.0.10`
bostr npm	`< 3.0.10`	`3.0.10`

Description

Even with authorized_keys is filled with allowed pubkeys, If noscraper is enabled, It will allow anyone to use bouncer even it's pubkey is not in authorized_keys.

Impact

Private bouncer

Patches

Available on version 3.0.10

Workarounds

Disable noscraper if you have authorized_keys being set in config

References

This line of code is the cause.

NVD description

Bostr is an nostr relay aggregator proxy that acts like a regular nostr relay. bostr let everyone in even having authorized_keys being set when noscraper is set to true. This vulnerability is fixed in 3.0.10.

References

Yonle/bostr security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-41962 · ADVISORY
Yonle/bostr commit 49181f4 · WEB
Yonle/bostr · PACKAGE
Yonle/bostr · WEB
Yonle/bostr release 3.0.10 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free