CVE-2023-45559: 
NixOS vulnerability analysis and mitigation

An issue in Tamaki_hamanoki Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. The vulnerability was discovered and disclosed on January 3, 2024, affecting the Line mini-app 'Tamaki_hamanoki'. The vulnerability has been assigned a CVSS v3.1 base score of 8.2 (HIGH) (NVD).

The vulnerability stems from the exposure of critical credentials (client secret) on the client side through the endpoint 'https://asia-northeast1-pibot-order-prod.cloudfunctions.net/userEntry'. This client secret can be used to obtain the channel access token, which secures communication within Line. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (GitHub Report).

The vulnerability affects any user of the Tamaki_hamanoki mini-app on Line. Attackers who obtain the channel access token can broadcast malicious messages through the compromised channel, potentially distributing fraudulent information, malicious links, and other harmful content (GitHub Report).