Context: https://www.techradar.com/news/nord-security-snaps-up-atlas-vpn
I don't know what's worse here.
Unauthenticated web interface
lack of CSRF that would prevent such blind requests
the web interface on a localhost port
that browsers still allow access to without asking any permission-related questions
Regardless of the current fix, websites will be able to find out if the user is a user of Atlas VPN, without any IP matching.
And in the case it's used by the client, it's a giant red flag of qualification, business direction and security practices at Atlas and Nord as a whole. Now that Nord positions itself as a cybersecurity company especially in the B2B segment, I can't explain how they don't have processes in place to audit the design choices of their acquired companies. This further reinforces my position to avoid them entirely.