CVE-2024-9312

Description

Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.

Reserved 2024-09-27 | Published 2024-10-10 | Updated 2024-10-10 | Assigner canonical

Problem types

CWE-286

Product status

Any version before 0.3.6
affected

Credits

nicoo finder

Michael Gebetsroither analyst

Jamie Bliss analyst

Adrian Dombeck remediation developer

Mark Esler coordinator

References

github.com/.../authd/security/advisories/GHSA-4gfw-wf7c-w6g2 issue-tracking

www.cve.org/CVERecord?id=CVE-2024-9312 issue-tracking

cve.org (CVE-2024-9312)

nvd.nist.gov (CVE-2024-9312)

Download JSON