From 9ff0d8c629df5946b46d26161c1e2d65b444a08e Mon Sep 17 00:00:00 2001
From: reverse <mike.chevronnet@gmail.com>
Date: Sun, 16 Aug 2026 17:48:21 +0000
Subject: [PATCH] s2s: apply METADATA accountname only from a services source

---
 src/link.rs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/link.rs b/src/link.rs
index d13f3a7..0c2dba4 100644
--- a/src/link.rs
+++ b/src/link.rs
@@ -808,6 +808,11 @@ impl Server {
             return;
         };
         if key == "accountname" {
+            // account login is a services authority: ignore it from an ordinary peer
+            // (each hop re-checks, so forwarding an unauthorised one stays harmless).
+            if !self.source_is_service(msg) {
+                return;
+            }
             if value.is_empty() || value == "*" {
                 self.logout(tuid);
             } else {