Found during a security audit.
Where: screen.js:4813 _followerBusHandler; also _lanHelloResponse (3735), _remoteConnect (5606)
Issue: The /ws/sync/{roomKey} relay (server-side, lives in the feedBack core repo) is an unauthenticated broadcast room: any client that connects with the room key can send song-changed, time, playstate, or share-ended messages, and every other viewer processes them as if they came from the legitimate host. Only config during pre-boot is scoped by popupId, and even that popupId is visible to every room member via the broadcast hello.
Impact: A malicious LAN peer who knows/guesses the 6-char room key can force-disconnect all viewers (fake share-ended), redirect them to a different locally-hosted song (fake song-changed), or spoof playback state.
Why not auto-fixed: This is inherent to the documented "trusted LAN room" broadcast model. A real fix requires connection-level host authentication on the server's /ws/sync relay — that's in the feedBack core repo, not something a client-only patch in this plugin can correctly provide. Filing here since the splitscreen plugin is the primary consumer of the relay; the actual fix belongs in feedBack's /ws/sync implementation (e.g. a host-issued per-connection token distinct from the shareable room key).
Found during a security audit.
Where:
screen.js:4813_followerBusHandler; also_lanHelloResponse(3735),_remoteConnect(5606)Issue: The
/ws/sync/{roomKey}relay (server-side, lives in thefeedBackcore repo) is an unauthenticated broadcast room: any client that connects with the room key can sendsong-changed,time,playstate, orshare-endedmessages, and every other viewer processes them as if they came from the legitimate host. Onlyconfigduring pre-boot is scoped bypopupId, and even thatpopupIdis visible to every room member via the broadcasthello.Impact: A malicious LAN peer who knows/guesses the 6-char room key can force-disconnect all viewers (fake
share-ended), redirect them to a different locally-hosted song (fakesong-changed), or spoof playback state.Why not auto-fixed: This is inherent to the documented "trusted LAN room" broadcast model. A real fix requires connection-level host authentication on the server's
/ws/syncrelay — that's in thefeedBackcore repo, not something a client-only patch in this plugin can correctly provide. Filing here since the splitscreen plugin is the primary consumer of the relay; the actual fix belongs infeedBack's/ws/syncimplementation (e.g. a host-issued per-connection token distinct from the shareable room key).