Security Policy

中文版本：安全策略

This chapter is the canonical home for ToughRADIUS security advisories and the guidance that goes with them. The repository's SECURITY.md keeps a short pointer back to this chapter so there is a single source of truth.

Security advisories

XSS vulnerability fix (v8.0.8)

Version v8.0.8 addresses a critical cross-site scripting (XSS) vulnerability. The issue was found in the errmsg parameter handling in the login endpoint.

Item	Details
Vulnerability type	Cross-Site Scripting (XSS)
Severity	Critical
Affected versions	v8.0.1 – v8.0.7
Fixed version	v8.0.8
Affected component	Login endpoint (errmsg parameter)

Recommended actions

We strongly recommend that all users update to the latest version immediately. See the Documentation Map for the README and build instructions you can follow to upgrade your deployment.