Bostr Improper Authorization vulnerability

Even with authorized_keys is filled with allowed pubkeys, If noscraper is enabled, It will allow anyone to use bouncer even it's pubkey is not in authorized_keys.

Impact

• Private bouncer

Patches

Available on version 3.0.10

Workarounds

Disable noscraper if you have authorized_keys being set in config

References

This line of code is the cause.