gts.superseriousbusiness.org
GoToSocial (@gotosocial@superseriousbusiness.org)
Hello folks! We've just made a security bugfix release of #GoToSocial, v0.22.2 Shrubbiest Sloth! https://codeberg.org/superseriousbusiness/gotosocial/releases/tag/v0.22.2 We recommend everyone on v0.22.1 and lower who uses two-factor authentication (2FA) for their account to update to this release ASAP. We fixed a two-factor authentication (2FA) security bug whereby an attacker who already knows a victim's email address + password, ie., the first factor authentication, could bypass having to input a code from an authenticator app, ie., the second factor of authentication, and obtain an OAuth token for that account. This bug only affects 2FA, and again, only in cases where an attacker already knows their victim's email address + password. Update instructions are in the release notes: it's a nice easy update if you're already on v0.22.x; and if you're already on main snapshots, just update to latest commits and you're good. Thanks for reading <3
