Improper Authentication Affecting github.com/zitadel/zitadel/internal/api/ui/login package, versions <2.58.7 >=2.59.0 <2.59.5 >=2.60.0 <2.60.4 >=2.61.0 <2.61.4 >=2.62.0 <2.62.7 >=2.63.0 <2.63.5
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.08% (37th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMZITADELZITADELINTERNALAPIUILOGIN-8309536
- published 29 Oct 2024
- disclosed 25 Oct 2024
- credit evilgensec, Daniel Peinhopf
Introduced: 25 Oct 2024
New CVE-2024-49757 Open this link in a new tabHow to fix?
Upgrade github.com/zitadel/zitadel/internal/api/ui/login to version 2.58.7, 2.59.5, 2.60.4, 2.61.4, 2.62.7, 2.63.5 or higher.
Overview
Affected versions of this package are vulnerable to Improper Authentication due to a missing security check in the registration URL. An attacker can bypass the user registration restrictions by directly accessing the specific URL.