Security researchers at Aikido have disclosed eight high-severity vulnerabilities in NodeBB, a widely used Node.js-based forum platform that powers online communities across the web. The flaws, uncovered during an AI-assisted whitebox penetration test, affect every version of NodeBB released before 4.14.0 and range from cross-site scripting bugs to authorization bypasses that could hand an attacker full control of a forum.

How the Bugs Were Found

What makes this disclosure notable isn’t just the number of flaws but how quickly they surfaced. Aikido’s testers leaned on AI-assisted analysis to chain together complex, interdependent bugs that would typically take a human researcher far longer to piece together. Several of the issues were exploitable straight out of the box on a default NodeBB install, meaning any unpatched deployment was immediately at risk rather than only misconfigured ones.

Three Ways to Inject Malicious Scripts

The most serious cluster of issues involves cross-site scripting. One flaw stems from how NodeBB handles federated user profiles: because the platform failed to properly sanitize data coming from a federation server, an attacker could stand up a malicious server and slip a crafted payload into a profile image field. When NodeBB rendered that data into an HTML meta tag, the attacker’s script would execute inside a victim’s browser.

A second XSS path runs through the admin panel itself. By sending deliberately malformed ActivityPub messages with mismatched origins, an attacker could plant malicious HTML inside NodeBB’s federation error logs. Since those logs weren’t properly escaped, an administrator simply opening the log viewer would unknowingly trigger the attacker’s code — effectively converting a routine troubleshooting task into a full admin compromise.

A third issue traces back to the order in which NodeBB processes templates and translations. Because templates render before translation strings are applied, attackers could smuggle translation syntax into fields a user controls, manipulating page attributes and triggering script execution through booby-trapped links.

Bypassing Authorization Entirely

Beyond scripting attacks, Aikido found several ways to sidestep NodeBB’s access controls outright. One bug allowed impersonation of any user because ActivityPub signature checks were only enforced on POST requests — attackers could simply switch to GET requests carrying an arbitrary user ID and pull private messages by iterating through message identifiers one by one.

• Abusing the custom homepage feature to point at an admin-only route, exposing error logs and user export data to unauthorized visitors.
• A mass-assignment flaw that let attackers overwrite existing posts by manipulating internal identifiers.
• An information-disclosure bug that leaked private category content through an unprotected ActivityPub endpoint.
• A logic flaw in the upvote system that let attackers forge ActivityPub “Like” activities to artificially inflate a post’s popularity without any real identity verification.

Fix Now Available

Aikido reported all eight issues through a responsible disclosure process, and the NodeBB team shipped fixes across the board in version 4.14.0, released in early July. The update tightens input sanitization, enforces stricter authorization checks on federation-related requests, and reworks how templates and translations are processed to close off the injection path. Administrators still running older releases are strongly urged to upgrade immediately, since several of the bugs required no special configuration to exploit.

A Broader Warning About Federated Protocols

The research is as much a case study in protocol design as it is a bug list. ActivityPub, the federation protocol NodeBB and platforms like Mastodon rely on, opens up multiple interaction paths between servers — and each one needs its own consistent security review. Inconsistent handling of federated input across NodeBB’s codebase is what allowed so many separate bugs to accumulate in the first place.

The disclosure also reflects a shift in how vulnerability research itself is conducted. AI-assisted tooling let Aikido’s team scale the kind of chained, multi-step exploitation analysis that used to be the domain of specialized manual researchers, hinting at how offensive security work — for both defenders and attackers — is likely to accelerate in the months ahead.