Bug: Admin role granted with zero credential verification — frontend-only auth

[Siddh2024]

Summary

AuthController.java:60-66 grants admin role and returns a token with zero credential verification. The comment at line 57 says "This is validated on frontend" — a critical design flaw.

Details

• File: AuthController.java lines 60-66
• if ("admin".equals(role)) { response.put("token", UUID.randomUUID().toString()); ... }
• No password check, no OTP verification for admin access
• Comment states frontend-only validation

Impact

Anyone who knows the admin role string can access the full admin dashboard and organ registry. Frontend-only auth is trivially bypassed.

Suggested Fix

Implement proper server-side authentication and authorization. Never trust frontend-only security checks.

[jaideep005]

Yeah, sure. I've assigned it now; you can work on