Linus Rath 1f19796cc2 fix: ignore admin status from a server the admin never configured (GHSA-j867-89p4-v8hm) ...

The Stalwart admin check only bailed while `allowCustomJmapEndpoint` was
on. A context cookie minted while it was on keeps naming the
user-chosen server, and the envelope has no expiry, so after the admin
turned the switch off that server could still answer the admin probe
and mint a Bulwark admin session. The check now also requires the
cookie's server to be an admin-configured one.

2026-09-26 14:20:36 +02:00

..

route.ts

fix: ignore admin status from a server the admin never configured (GHSA-j867-89p4-v8hm)

2026-09-26 14:20:36 +02:00