PT-2024-27471

CVE-2024-37312

Published

2024-06-14

Updated

2025-08-14

Description by

CVSS 3.1

6.3

Medium

MetricsAV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions user oidc app versions prior to 3.0.0 user oidc app versions prior to 4.0.0 user oidc app versions prior to 5.0.0

Description The issue is related to missing access control on the ID4me endpoint, allowing an attacker to register an account and potentially gain access to data available to all registered users.

Recommendations For versions prior to 3.0.0, upgrade to version 3.0.0 or later. For versions prior to 4.0.0, upgrade to version 4.0.0 or later. For versions prior to 5.0.0, upgrade to version 5.0.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Lukasreschke

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

Related identifiers

CVE-2024-37312