ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2024-34065

3rd party token leak and authentication bypass

Published Jun 12, 2024 · catalog updated Jun 12, 2024 · 3rd party token leak

Last checked Nov 7, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2024-34065. EPSS is 0.70%. Act only if a listed version of 3rd party token leak is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (3rd party token leak).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.1
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.70%
Remediation
Version ranges on file
Affected products
cpe strapi/strapi · npm @strapi/plugin-users-permissions

Our report includes two vulnerabilities that we deemed appropriate to report together as the combined effect of leveraging both is higher than what it would appear if you triage each separately. Feel free to break up this report in two, if you think it is pertinent. These vulnerabilities were found while performing an audit of a customer's application that used Strapi. The technical details, screenshots, PoC code and suggestions for possible fixes are below. ### Summary By combining two vulnerabilities (an and ) in Strapi framework is its possible of an unauthenticated attacker to bypass authentication mechanisms and retrieve the 3rd party tokens. The attack requires user interaction (one click). ### Impact Unauthenticated attackers can leverage two vulnerabilities to obtain an 3rd party token and the bypass authentication of Strapi apps. ### Technical details #### Vulnerability 1: Open Redirect ##### Description Open redirection vulnerabilities arise when an application incorporates user-controllable data into the target of a redirection in an unsafe way. An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain. In the specific context of Strapi, this vulnerability allows the SSO token to be stolen, allowing an attacker to authenticate himself within the application. ##### Remediation If possible, applications should avoid incorporating user-controllable data into redirection targets. In many cases, this behavior can be avoided in two ways: - Remove the redirection function from the application, and replace links to it with direct links to the relevant target URLs. - Maintain a server-side list of all URLs that are permitted for redirection. Instead of passing the target URL as a parameter to the redirector, pass an index into this list. If it is considered unavoidable for the redirection function to receive user-controllable input and incorporate this into the redirection target, one of the following measures

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe strapi/strapi< 4.24.2
  • npm @strapi/plugin-users-permissions<= 4.24.1

How to fix CVE-2024-34065

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2024-34065. EPSS is 0.70%. Act only if a listed version of 3rd party token leak is installed.

Which versions are affected?

Compare what you have installed with < 4.24.2, <= 4.24.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-294; CWE-601: URL Redirection to Untrusted Site (Open Redirect). EPSS 0.70%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Strapi security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 12, 2024 · Maintainer security tabs

    Detected

    Our report includes two vulnerabilities that we deemed appropriate to report together as the combined effect of leveraging both is higher than what it would appear if you triage each separately. Feel free to break up this report in two, if you think it is pertinent. These vulnerabilities were found while performing an audit of a customer's application that used Strapi. The technical details, scree

Sources

  • CVE.orgVulnerability recordCVE-2024-34065

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2024-34065

    30-day exploitation probability 0.70%

    first.org
  • Maintainer security tabsVendor advisoryGHSA-wrvh-rcmr-9qfc

    Our report includes two vulnerabilities that we deemed appropriate to report together as the combined effect of leveraging both is higher than what it would appear if you triage each separately. Feel free to break up this report in two, if you think it is pertinent. These vulnerabilities were found while performing an audit of a customer's application that used Strapi. The technical details, scree

    github.com
  • Monitored products — highVendor advisoryCVE-2024-34065

    Strapi is an open-source content management system. By combining two vulnerabilities (an and ) in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and retrieve the 3rd party tokens. The attack requires user interaction (one click). Unauthenticated attackers can leverage two vulnerabilities to obtain an 3rd pa

    nvd.nist.gov

References

Freshness

Last verified in this catalog Nov 7, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 7, 2026
  • Maintainer security tabsNov 7, 2026
  • Monitored products — highNov 4, 2026
  • CVE.orgNov 2, 2026