From 7c6d3960425198105c07d225481665904e7fb6da Mon Sep 17 00:00:00 2001
From: LD-Reborn <lucretia.dietz@gmx.de>
Date: Sat, 18 Jul 2026 12:20:08 +0200
Subject: [PATCH] fix(auth): fixes unlimited access when no authentication is
 set up

---
 src/ReverseLlama.Server/AdminEndpoints.cs | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/ReverseLlama.Server/AdminEndpoints.cs b/src/ReverseLlama.Server/AdminEndpoints.cs
index d66bd42..c77fb57 100644
--- a/src/ReverseLlama.Server/AdminEndpoints.cs
+++ b/src/ReverseLlama.Server/AdminEndpoints.cs
@@ -41,6 +41,14 @@ internal static class AdminEndpoints
         {
             api.RequireAuthorization();
         }
+        else
+        {
+            api.AddEndpointFilter((context, next) =>
+                new ValueTask<object?>(
+                    Results.Json(
+                        new { error = "No authentication configured - authentication required to use the admin API" },
+                        statusCode: StatusCodes.Status403Forbidden)));
+        }
 
         api.MapGet("/summary", (HttpContext context, TunnelHub hub, ManagementStore store) =>
             Results.Json(BuildSummary(context.User, hub, store, settings)));