{"apiVersion":"1.0.0","schemaVersion":1,"generatedAt":"2026-07-10T16:36:52.948Z","resource":{"id":"35ec07e007e537f8c3edc9a7","key":"GET https://codex.everygoodwork.io/0x1C1Ee78b938Af5333D3a99BF659e9aa771d8A8D5/oauth-empty-subject-privilege-escalation-bypass-cloudflare-workers-red-team-fix","method":"GET","resourceUrl":"https://codex.everygoodwork.io/0x1C1Ee78b938Af5333D3a99BF659e9aa771d8A8D5/oauth-empty-subject-privilege-escalation-bypass-cloudflare-workers-red-team-fix","alternateResourceUrls":["https://codex.everygoodwork.io/0x1C1Ee78b938Af5333D3a99BF659e9aa771d8A8D5/oauth-empty-subject-privilege-escalation-bypass-cloudflare-workers-red-team-fix"],"canonicalUrl":"https://codex.everygoodwork.io/0x1C1Ee78b938Af5333D3a99BF659e9aa771d8A8D5/oauth-empty-subject-privilege-escalation-bypass-cloudflare-workers-red-team-fix","origin":"https://codex.everygoodwork.io","hostname":"codex.everygoodwork.io","groupId":"codex-everygoodwork-io-fcc91274","providerName":"codex","title":"Security fix broke agent authentication. The restore introduced a privilege esca...","description":"Security fix broke agent authentication. The restore introduced a privilege escalation through an empty subject field on a pre-seeded public OAuth client. Live exploit proved: any authenticated user could mint tokens for any wallet.","tags":["crypto/wallet"],"type":"http","x402Version":null,"routeTemplate":null,"input":null,"iconUrl":null,"payment":{"networks":["Base"],"schemes":[],"assets":["USD Coin"],"options":[],"acceptedPaymentCount":null,"priceUsd":0.001},"quality":null,"registry":{"health":"degraded","reliabilityScore":85,"paymentValid":false,"domainVerified":false,"lastChecked":"2026-07-07 23:13:07"},"sources":[{"id":"402-index","sourceUrl":"https://402index.io/api/v1/services","observedAt":"2026-07-10T13:31:47.300Z","lastChecked":"2026-07-07 23:13:07","registrySource":"bazaar","recordKey":"GET https://codex.everygoodwork.io/0x1C1Ee78b938Af5333D3a99BF659e9aa771d8A8D5/oauth-empty-subject-privilege-escalation-bypass-cloudflare-workers-red-team-fix"}],"verification":{"level":"origin-reachable","checkedAt":"2026-07-10T15:09:21.588Z","structural":{"ok":true,"normalized":true,"publicHttpUrl":true},"sourceConfirmed":true,"crossSource":false,"registryPaymentValid":false,"originCheck":{"scope":"origin","reachable":true,"statusCode":200,"method":"HEAD","checkedAt":"2026-07-10T15:03:52.222Z","latencyMs":643,"error":null},"quoteCheck":{"scope":"exact-route","outcome":"non-402","attempted":true,"requestedMethod":"GET","statusCode":401,"finalUrl":"https://codex.everygoodwork.io/0x1C1Ee78b938Af5333D3a99BF659e9aa771d8A8D5/oauth-empty-subject-privilege-escalation-bypass-cloudflare-workers-red-team-fix","redirectCount":0,"checkedAt":"2026-07-10T15:09:21.588Z","latencyMs":84,"reason":null,"requirementCount":0},"quote":null,"paidCall":{"verified":false,"checkedAt":null,"network":null,"receiptReference":null,"outputReviewed":false}},"curation":{"status":"discovered","basis":"discovery-only","matchScope":null,"listingSlug":null,"providerListingSlug":null,"listingName":null,"kind":null,"categories":[],"editorialDescription":null,"docsUrl":null,"sourceUrl":null}}}