Eight high-severity security flaws in the **NodeBB** forum software, along with their exploit code, were made public on Wednesday. **Aikido Security**, which rated all eight as high severity, reported that its AI pentest agents identified these vulnerabilities during a six-hour review of **NodeBB**'s source code. All **NodeBB** versions before 4.14.0 are impacted. The maintainers have since patched all issues, and administrators should ensure their installations are updated to version 4.14.2. ### Critical Access and Data Exposure One of the simpler flaws allowed a regular forum member to gain access to the admin dashboard by merely pointing their homepage setting to the admin address and reloading the page. This bypass, which sidestepped a client-side browser block, granted read-only access to elements like error logs and exported user lists, though it also permitted changing the site logo. Two additional vulnerabilities allowed unauthenticated attackers to access private information. One enabled an attacker to impersonate any user and read private messages individually, while the other exposed the contents of private categories to anyone making the correct request. ### Cross-Site Scripting and Federation Risks The most widespread flaw resided in **NodeBB**'s page rendering process. User input could smuggle in translation codes during a second pass of page construction, allowing an attacker to plant malicious links almost anywhere on the site, including within ordinary forum posts. Clicking these links would execute the attacker's code. Other vulnerabilities included the ability to take over existing posts, artificially inflate post vote counts, and execute two attacks that plant malicious code via a fake server on the **Fediverse** — the network of connected social sites that **NodeBB** forums can join. ### Exposure Levels Vary by Configuration Not all eight flaws posed the same level of risk. Three required no account on the target forum, two needed an ordinary member account, and the remaining three relied on a user clicking a malicious link or opening a specific page. According to The Hacker News, five of the eight vulnerabilities were located in **NodeBB**'s federation code, which handles connections to platforms like **Mastodon**. Forums freshly installed with version 4 had federation enabled by default, making them susceptible to all eight flaws. However, forums upgraded from version 3 had federation automatically switched off, meaning only three of the vulnerabilities applied unless an administrator manually re-enabled the feature.  **Aikido Security** did not publish individual severity scores for the flaws, nor did **NodeBB**'s release notes. However, **NodeBB**'s own bug bounty scale categorizes cross-site scripting (XSS) and account takeover as high severity, with admin access rated as critical. ### Patching Timeline and Recommendations **NodeBB** quietly patched most of these vulnerabilities in stages. Four fixes shipped in May, two in June, and the most significant — a complete rebuild of how the software handles page text — arrived with version 4.14.0 on July 9. This rebuild affected 325 files. There is a discrepancy between **Aikido**'s report, which states fixes were implemented in early July, and **NodeBB**'s release history. For instance, the link for the admin-panel fix points to a change made in January 2024, two years prior to the review, while **NodeBB**'s release notes cite a different change from May. The reason for this gap remains unexplained. Administrators are strongly advised to upgrade to **NodeBB** version 4.14.2, released on July 23. This update may require additional work, as version 4.14.0's changes to page template text handling could necessitate updates to custom themes and plugins. Simply disabling federation is not a complete solution, as three of the disclosed flaws are unrelated to it. None of the eight vulnerabilities have been assigned a **CVE** tracking number, and no active exploits have been reported. Separately, a different **NodeBB** federation flaw, **CVE-2026-58593**, was filed on July 1. This flaw, not among **Aikido**'s eight, resides in the same code and allows an external server to post and send messages in the name of any local account, including administrators. It requires federation to be enabled, and a fixed version has not yet been specified. ### The Rise of AI in Vulnerability Discovery While **NodeBB**'s bug bounty program typically rejects AI-generated reports and only pays for human-performed work, these eight vulnerabilities were reported directly to the maintainers and subsequently patched. This incident highlights a growing trend: **NodeBB** is not alone in addressing AI-discovered flaws. The automation platform **n8n** patched a login flaw in June, also found by an AI pentest agent. **NodeBB** co-founder Julian Lam noted in a release announcement that valid security reports arrived steadily throughout the month, with "almost all AI discovered and generated." All eight vulnerabilities share a common pattern: **NodeBB** performed authentication checks for the primary access route to a feature but bypassed these checks for alternative, less obvious routes leading to the same functionality.