CVE-2018-3778

Description

Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized.

Affected products

• HackerOne / aedes>=0.35.1 – >=0.35.1

References

• MISChttps://github.com/nodejs/security-wg/blob/master/vuln/npm/457.json
• MISChttps://github.com/mcollina/aedes/issues/212
• MISChttps://github.com/mcollina/aedes/issues/211