From 222408af6fd4bd85554a25ec8de8131bd0733797 Mon Sep 17 00:00:00 2001 From: Karl Ludwig Weise Date: Tue, 5 May 2026 03:58:03 +0200 Subject: [PATCH] Fix malicious global admin account creation using setup route again --- .../(pages)/setup/create-admin-account/+page.server.ts | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/routes/(pages)/setup/create-admin-account/+page.server.ts b/src/routes/(pages)/setup/create-admin-account/+page.server.ts index 5eb2cad..0d851e7 100644 --- a/src/routes/(pages)/setup/create-admin-account/+page.server.ts +++ b/src/routes/(pages)/setup/create-admin-account/+page.server.ts @@ -25,6 +25,13 @@ export const actions: Actions = { }); } + if (await UserService.adminExists()) { + log.error("Create global admin forbidden. Admin already exists.", { errors: form.errors }); + return fail(403, { + form: { ...form, data: { ...form.data, type: "passkey" } }, + }); + } + // IMPORTANT: Verify passkey BEFORE creating user to avoid orphaned users let verificationResult: | { credentialID: string; credentialPublicKey: string; counter: number }