1. Koda Platform Exposed: Auth Cookie Lacks Secure/SameSite Attributes, Enabling Token Theft via XSS
A critical security misconfiguration in the Koda platform's authentication system leaves user sessions vulnerable to hijacking. The platform's JWT authentication cookie is created with default, insecure options, failing to enforce the `secure` and `sameSite` attributes. This oversight means the sensitive token is trans...