Summary
By default, when Scrob is deployed to the web, the first visitor can immediately register an account and become the admin without any authentication or gating mechanism. This is a significant security risk for users who are unaware of this behavior during initial setup.
Current Behavior
According to the configuration documentation:
The first user can always register regardless of this setting.
This means:
ENABLE_REGISTRATIONS=true (default) allows anyone to register- Even if
ENABLE_REGISTRATIONS=false, the first user can still register
- There's no setup wizard, initial token requirement, or other protective mechanism
- On first visit to a publicly accessible instance, anyone can claim the admin account
Risk Scenario
- User deploys Scrob to a public URL (e.g.,
scrob.example.com)
- URL becomes immediately accessible
- Before the admin can visit and register themselves, a malicious actor visits first
- Malicious actor registers as admin and gains full control of the instance
- Legitimate admin is locked out or must delete the malicious account via database access
Why This Is Bad Design
This assumes deployment in a trusted environment where initial access is controlled. But in practice:
- Platforms like Railway, Render, Vercel make URLs instantly public
- Users may not read security documentation during setup
- The default behavior should be secure; security shouldn't rely on the operator remembering to configure it
Suggested Mitigations
- Require an initial setup token/password before any registration (one-time use)
Default to ENABLE_REGISTRATIONS: false — require explicit opt-in for public registration- Implement a setup wizard that must be completed before the instance is usable (similar to Nextcloud, Immich, Jellyfin)
Workarounds (Current)
Users can currently protect themselves by:
- Setting up OIDC/SSO with
OIDC_DISABLE_PASSWORD_LOGIN=true before deploying publicly
- Keeping the instance on a private network until admin setup is complete
But these require security awareness that many users lack during initial deployment.
Summary
By default, when Scrob is deployed to the web, the first visitor can immediately register an account and become the admin without any authentication or gating mechanism. This is a significant security risk for users who are unaware of this behavior during initial setup.
Current Behavior
According to the configuration documentation:
This means:
ENABLE_REGISTRATIONS=true(default)allows anyone to registerENABLE_REGISTRATIONS=false, the first user can still registerRisk Scenario
scrob.example.com)Why This Is Bad Design
This assumes deployment in a trusted environment where initial access is controlled. But in practice:
Suggested Mitigations
Default toENABLE_REGISTRATIONS: false— require explicit opt-in for public registrationWorkarounds (Current)
Users can currently protect themselves by:
OIDC_DISABLE_PASSWORD_LOGIN=truebefore deploying publiclyBut these require security awareness that many users lack during initial deployment.