CVE-2026-54477: Admin Panel Missing Security Headers (clickjacking / XSS)

Advisory

Product

Summary

The admin panel is served with no security headers beyond HSTS — no Content-Security-Policy, no X-Frame-Options, no X-Content-Type-Options, no Permissions-Policy. This enables clickjacking and cross-site scripting against authenticated admin sessions.

Vulnerability Details

Headers present

Headers missing

Clickjacking scenario

With no X-Frame-Options / CSP frame-ancestors, an invisible overlay iframe over an authenticated admin session can trigger privileged actions on click, e.g. PiReboot, DeleteUser, SwitchBannedDevice.

XSS amplification

Combined with the client-side injection sinks identified in Gr0m-028 (22 dangerouslySetInnerHTML instances, 35 innerHTML assignments), the absence of CSP means any successful payload executes without restriction, enabling data exfiltration and session-propagating behavior.

Mapping to coordinated findings

Remediation

Per ICSA-26-183-03, Gardyn states the IoT Hub deployed infrastructure has been updated to address the listed vulnerabilities. Recommended control set (Netlify _headers / netlify.toml):

[[headers]]
  for = "/*"
  [headers.values]
    Content-Security-Policy = "default-src 'self'; script-src 'self'; frame-ancestors 'none';"
    X-Frame-Options = "DENY"
    X-Content-Type-Options = "nosniff"
    Referrer-Policy = "strict-origin-when-cross-origin"
    Permissions-Policy = "camera=(), microphone=(), geolocation=()"

Researcher: Michael Groberman (Gr0m) · Case: CERT/CC VU#653116 · Advisory: ICSA-26-183-03