{"action":"Upgrade @redwoodjs/api to 2.2.5 or later.","affected":[{"fixed":"2.2.5","introduced":"0.38.0"},{"fixed":"3.3.1","introduced":"3.0.0"}],"component":"@redwoodjs/api","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2.2.5","3.3.1"],"ghsa_id":"GHSA-3qmc-2r76-4rqp","id":"tcs_01M5KEY3KMYTJ5S5S15YXNFENS","modified_at":"2022-11-10T15:51:01Z","published_at":"2022-11-10T15:51:01Z","references":["https://osv.dev/vulnerability/GHSA-3qmc-2r76-4rqp","https://github.com/redwoodjs/redwood/security/advisories/GHSA-3qmc-2r76-4rqp","https://github.com/redwoodjs/redwood/issues/6343","https://github.com/redwoodjs/redwood/pull/6778","https://github.com/redwoodjs/redwood","https://github.com/redwoodjs/redwood/releases/tag/v2.2.5","https://github.com/redwoodjs/redwood/releases/tag/v3.3.1"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-3qmc-2r76-4rqp","url":"https://osv.dev/vulnerability/GHSA-3qmc-2r76-4rqp"}],"summary":"Redwood is vulnerable to account takeover via dbAuth \"forgot-password\""}