phone-tunnel-pool

/iptunnel/entry is listed in PUBLIC and is answered before authentication, yet the page body contains base64('dsh:'+PASS) - i.e. the exact Basic credential. Any internet client that learns the quick-tunnel hostname (browsed, shared, screenshotted, or found in history) can GET https://<host>/iptunnel/entry; the page's own script then calls /iptunnel/preauth with that credential, receives the dsh_auth cookie and redirects to '/', so the visitor lands fully logged into the exposed dsh harness. This directly contradicts the file's own comment that public paths expose 'ONLY hostnames and liveness -

The long-lived tunnel password is written into the body of every proxied HTML page (the watchdog needs it for /iptunnel/preauth). It is therefore readable by any script executing in the origin and is stored in page sources/caches, so one content-injection or malicious page in the harness escalates into a reusable tunnel credential that works from anywhere (unlike the per-browser dsh_auth cookie). It also duplicates the exposure of finding 1 on the authenticated path.

The credential gating the public tunnel is produced by V8's non-cryptographic Math.random. Entropy is still roughly 144 bits so brute force stays impractical, but a security-relevant secret should never come from a PRNG with no predictability guarantees; if the same process ever leaks other Math.random outputs the password becomes recoverable.

The password ends up in the argv of the short-lived python3 process; on Linux /proc/<pid>/cmdline is world-readable, so any local user can read the live tunnel credential while a QR is rendered - the very exposure the daemon avoids for cloudflared ('password arrives ONLY via DSH_PROXY_PASS env, never argv') and deliberately strips from cloudflared's environment.