The /register endpoint in main.py accepts any password string without any validation — a single character, a space, or a common password like "password" or "123" is accepted and bcrypt-hashed without complaint. There is no minimum length check, no complexity requirement, and no check against common password lists.
This is a forensic security tool used by SOC analysts. Weak operator passwords directly undermine the JWT authentication system that was specifically added to protect the /analyze endpoint. An attacker who can brute-force or guess a weak password gets a valid JWT and full access to the analysis engine.
The frontend handleRegister() in index.js also has no client-side password strength feedback — the user gets no indication that their password is weak until after the account is created (which it always is, regardless of strength).
The fix requires: minimum length enforcement (e.g. 12 characters), a server-side check before hashing, and a clear error response with the requirements. Optionally a client-side strength indicator.
The
/registerendpoint inmain.pyaccepts any password string without any validation — a single character, a space, or a common password like"password"or "123" is accepted and bcrypt-hashed without complaint. There is no minimum length check, no complexity requirement, and no check against common password lists.This is a forensic security tool used by SOC analysts. Weak operator passwords directly undermine the JWT authentication system that was specifically added to protect the /
analyzeendpoint. An attacker who can brute-force or guess a weak password gets a valid JWT and full access to the analysis engine.The frontend
handleRegister() inindex.jsalso has no client-side password strength feedback — the user gets no indication that their password is weak until after the account is created (which it always is, regardless of strength).The fix requires: minimum length enforcement (e.g. 12 characters), a server-side check before hashing, and a clear error response with the requirements. Optionally a client-side strength indicator.