@AIcivilization/dsh-vps

The gate runs behind Caddy, which appends the real client address to an existing X-Forwarded-For header instead of overwriting it. Taking element [0] lets a remote attacker pick the value the limiter keys on, so a fresh fake IP per request means the 5-failures/5-minutes window never triggers. Unlimited password guessing against /login, /setup and /gate/password (which reuses the same counter) becomes possible.

main() dispatches /setup before the session check, and handleSetup only tests whether state/setup.lock exists. After a normal install both setup.lock and setup.token are present, but in any state where the lock file is missing (partial restore, manual cleanup, or a reset-admin path that drops the lock) /setup is exposed to the internet; because the token file is deleted on completion, setupTokenValid degrades to 'always true', so an unauthenticated attacker can POST /setup and replace the administrator username and password, taking over the deployment.

Browsers normalise '\' to '/' for http(s) URLs, so /\evil.com is resolved as the protocol-relative //evil.com. The value is echoed in the login form and then used as the Location header after a successful sign-in, so a victim lured to /login?next=/\evil.com is redirected to an attacker-controlled site immediately after authenticating — usable for phishing that starts on the genuine host.