NodeBB, a popular forum software, recently addressed eight critical security vulnerabilities found by AI-driven pentest agents from Aikido Security. These vulnerabilities, identified within a six-hour review of the software’s source code, were rated as high severity. They affected all versions prior to 4.14.0. The vulnerabilities ranged from unauthorized access to admin dashboards to exposure of private messages and categories. Notably, one flaw allowed a regular forum member to access the admin dashboard simply by changing a settings field. Other issues included the ability for attackers to impersonate users and read their private messages, as well as plant malicious links within forum posts. Five of these flaws were associated with NodeBB’s federation code, which connects forums to social sites like Mastodon. Forums installed with version 4 had federation enabled by default, making them more susceptible. NodeBB has been proactive in addressing these issues, with fixes implemented across several updates. Administrators are strongly advised to upgrade to version 4.14.2, released on July 23, as previous versions are vulnerable. The update may require additional work to ensure compatibility with custom themes and plugins, given significant changes in how page templates handle text. Despite the high severity of these vulnerabilities, no CVE tracking numbers have been assigned, and there have been no reported attacks exploiting them. Administrators should remain vigilant, as NodeBB’s federation feature still poses risks if enabled. A separate vulnerability, CVE-2026-58593, highlights the potential for external servers to exploit federation for unauthorized actions. NodeBB continues to reject AI-generated security reports, emphasizing the need for human validation in their bug bounty program. This case underscores the growing role of AI in identifying security flaws, with similar instances reported in other platforms like n8n.