Changerawr PoCs

Proof-of-concept scripts for three disclosed unauthenticated API issues in Changerawr. Use them only against an instance you own or have written authorization to test.

These PoCs are for people validating a Changerawr deployment they maintain or have written authorization to test. They target Changerawr versions before v1.0.6. On v1.0.6 and later, the tested requests should fail unless the caller is in the allowed setup state or is authenticated with the right access.

The scripts send real API requests. Use disposable test values.

• Finding 1 creates an invitation and attempts to register an admin account.
• Finding 2 updates OAuth provider configuration.
• Finding 3 exercises the custom-domain CRUD routes.

Setup

Required local tools:

• bash
• curl
• jq

Configure the target and PoC values:

cp .env.example .env
chmod +x lib/common.sh */*.sh

Edit .env before running a PoC. Use a non-production Changerawr instance when possible.

Run one folder after .env is configured:

cd 01-setup-invitations-admin-takeover
./poc.sh

The three findings:

#	Folder	Issue	Patched in
1	01-setup-invitations-admin-takeover	Unauthenticated setup invitations can mint an ADMIN invite and register an admin account	Changerawr v1.0.6
2	02-setup-oauth-provider-hijack	Unauthenticated OAuth setup can persist attacker-controlled provider endpoints	Changerawr v1.0.6
3	03-custom-domains-unauth-crud	Unauthenticated custom-domain list, add, verify, and delete operations	Changerawr v1.0.6

Patch notes

Changerawr v1.0.6 was released on 2026-04-16. Its changelog warns that previous releases contain security vulnerabilities and records security patches for disclosed issues.

The relevant code changes first appear between v1.0.5 and v1.0.6:

• setup invitation and OAuth setup routes reject access after setup is complete
• custom-domain list, add, verify, and delete routes require an authenticated user
• custom-domain routes stop trusting client-supplied userId and admin flags

Changerawr v1.0.6.1 contains the same endpoint patches for these PoCs.

References:

• https://github.com/Supernova3339/changerawr/blob/master/CHANGELOG.md#v106
• https://github.com/Supernova3339/changerawr/compare/v1.0.5...v1.0.6
• https://github.com/Supernova3339/changerawr/releases/tag/v1.0.6.1

License: MIT. See LICENSE.

Each folder has a README with the required .env values and the expected fixed behavior.