Fix Snyk security findings: XSS, open redirect, hardcoded secrets, cookie security, MD5 replacement

src/lib/auth/laravel-encrypter.ts

@@ -30,8 +30,10 @@ export class LaravelEncrypter {
   encrypt(value: string, serialize = true): string {
     const iv = randomBytes(16);
     const data = serialize ? phpSerializeString(value) : value;
-    // CBC mode is required for Laravel compatibility. Integrity is provided by
-    // the HMAC-SHA256 mac (verified by decrypt before any output is returned).
+    // AES-256-CBC is required for Laravel compatibility. Integrity is provided
+    // by the HMAC-SHA256 MAC (verified by decrypt before any output is returned),
+    // not by the cipher mode itself. Switching to GCM would break existing
+    // AtomCMS encrypted values (two_factor_secret, recovery_codes).
     const cipher = createCipheriv("aes-256-cbc", this.key, iv);
     const valueB64 = cipher.update(data, "utf8", "base64") + cipher.final("base64");
     const ivB64 = iv.toString("base64");
@@ -53,7 +55,8 @@ export class LaravelEncrypter {
       throw new Error("The MAC is invalid.");
     }
     const iv = Buffer.from(json.iv, "base64");
-    // CBC mode required for Laravel compatibility; MAC already verified above.
+    // AES-256-CBC required for Laravel compatibility; MAC already verified
+    // above so padding-oracle / tampering is not a risk.
     const decipher = createDecipheriv("aes-256-cbc", this.key, iv);
     const plain = decipher.update(json.value, "base64", "utf8") + decipher.final("utf8");
     return serialize ? phpUnserializeString(plain) : plain;