From 12f38ecb6867860d0ac242c11fe3a3f2d95a7f18 Mon Sep 17 00:00:00 2001
From: Niko Marmeladkov <niko@n1kt.ru>
Date: Wed, 1 Jul 2026 14:59:39 +0300
Subject: [PATCH] handleAuthCert: reject cert-auth when number differs from
 session

If session already has a number (from PoW), cert auth must match that number. Prevents identity theft via cert-sharing.
---
 internal/server/server.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/internal/server/server.go b/internal/server/server.go
index e5bfb26..3361623 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -351,7 +351,8 @@ func (s *Server) handleAuthCert(sess *Session, payload []byte) {
 	}
 
 	if sess.IsAuthenticated() && sess.Number() != ident.Number {
-		s.Unregister(sess.Number())
+		sendOpError(sess.Stream(), types.ErrAuthFailed, "cert number mismatch")
+		return
 	}
 
 	sess.Authenticate(ident.Number, pubKey, certDER)