Skip to content

fix(security): captcha bypass via predictable test account patterns #2462

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
failsafesecurity wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(security): captcha bypass via predictable test account patterns #2462

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions packages/modal/src/ui/containers/Login/Login.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,7 +185,9 @@ function Login(props: LoginProps) {
});

let token: string | undefined = undefined;
if (!isTestAccountPattern(authConnection, loginHint)) {
const isDev = process.env.NODE_ENV !== "production";
const requiresCaptcha = !(isDev && isTestAccountPattern(authConnection, loginHint));
Copy link
Copy Markdown

@cursor cursor Bot Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Captcha bypass persists when NODE_ENV is undefined

High Severity

The process.env.NODE_ENV check is unreliable for this library because the package's own rollup build config only replaces process.env.WEB3AUTH_VERSION, not process.env.NODE_ENV. The raw string is shipped to consumers, and if their bundler doesn't substitute it (or if process.env is undefined in the browser), then undefined !== "production" evaluates to true, making isDev true and keeping the captcha bypass active in production. This undermines the security fix entirely for affected environments.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 14c1d02. Configure here.

if (requiresCaptcha) {
const res = await captchaRef.current?.execute({ async: true });
if (!res) {
throw WalletLoginError.connectionError("Captcha token is required");
Expand Down Expand Up @@ -660,4 +662,4 @@ function Login(props: LoginProps) {
);
}

export default Login;
export default Login;