CVE-2024-8995

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description Unused authorization codes issued to deleted users are not properly invalidated or removed from the system, allowing them to persist and potentially be reused. An attacker with the authorization code and the associated client credentials, specifically client ID and client secret, can use these codes to obtain access tokens for deleted users. This can result in unauthorized access to sensitive resources and services based on the scopes originally authorized for the code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.