Common Weakness Enumeration

CWE-287

Discouraged

Improper Authentication

Abstraction: Class · Status: Draft

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

5964 vulnerabilities reference this CWE, most recent first.

GHSA-V9HX-V6VF-G36J

Vulnerability from github – Published: 2023-10-17 13:23 – Updated: 2023-10-17 13:23

Summary

WebAuthn4J Spring Security Improper signature counter value handling

Details

Improper signature counter value handling

Impact

A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected.

Patches

Please upgrade to com.webauthn4j:webauthn4j-spring-security-core:0.9.1.RELEASE

References

For more details about WebAuthn signature counters, see WebAuthn specification 6.1.1. Signature Counter Considerations.

Reporter

This issue was discovered by Michael Budnick (@mbudnick)

Severity

4.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.webauthn4j:webauthn4j-spring-security-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.1.RELEASE"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-45669"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-17T13:23:20Z",
    "nvd_published_at": "2023-10-16T19:15:11Z",
    "severity": "MODERATE"
  },
  "details": "Improper signature counter value handling\n\n### Impact\n\nA flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work.\nAn attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected.\n\n### Patches\n\nPlease upgrade to `com.webauthn4j:webauthn4j-spring-security-core:0.9.1.RELEASE`\n\n\n### References\n\nFor more details about WebAuthn signature counters, see [WebAuthn specification 6.1.1. Signature Counter Considerations](https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-sign-counter).\n\n### Reporter\n\nThis issue was discovered by Michael Budnick (@mbudnick)\n",
  "id": "GHSA-v9hx-v6vf-g36j",
  "modified": "2023-10-17T13:23:20Z",
  "published": "2023-10-17T13:23:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/webauthn4j/webauthn4j-spring-security/security/advisories/GHSA-v9hx-v6vf-g36j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45669"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webauthn4j/webauthn4j-spring-security/commit/129700d74d83f9b9a82bf88ebc63707e3cb0a725"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/webauthn4j/webauthn4j-spring-security"
    },
    {
      "type": "WEB",
      "url": "https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-sign-counter"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "WebAuthn4J Spring Security Improper signature counter value handling"
}

GHSA-V9R8-FPCM-RHVM

Vulnerability from github – Published: 2022-05-24 17:45 – Updated: 2022-07-13 00:01

Details

On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-22997"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-31T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.",
  "id": "GHSA-v9r8-fpcm-rhvm",
  "modified": "2022-07-13T00:01:10Z",
  "published": "2022-05-24T17:45:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22997"
    },
    {
      "type": "WEB",
      "url": "https://support.f5.com/csp/article/K34074377"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-V9RM-7RV9-R3FW

Vulnerability from github – Published: 2023-05-12 09:30 – Updated: 2023-05-22 21:30

Summary

Apache OpenMeetings Improper Authentication vulnerability

Details

An attacker that has gained access to certain private information can use this to act as other user.

Vendor: The Apache Software Foundation

Versions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.openmeetings:openmeetings-parent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.3"
            },
            {
              "fixed": "7.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-29032"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-12T20:17:54Z",
    "nvd_published_at": "2023-05-12T08:15:08Z",
    "severity": "HIGH"
  },
  "details": "An attacker that has gained access to certain private information can use this to act as other user.\n\nVendor: The Apache Software Foundation\n\nVersions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0",
  "id": "GHSA-v9rm-7rv9-r3fw",
  "modified": "2023-05-22T21:30:33Z",
  "published": "2023-05-12T09:30:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29032"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/openmeetings/commit/4e89e0ca076c83f26562f1146cf3e81ba0b16a7f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/openmeetings"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/OPENMEETINGS-2764"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/j2d6mg3rzcphfd8vvvk09d8p4o9lvnqp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache OpenMeetings Improper Authentication vulnerability"
}

GHSA-V9XM-FFX2-7H35

Vulnerability from github – Published: 2026-03-18 19:48 – Updated: 2026-03-19 21:14

Summary

ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

Details

MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

Summary

The bearer token authentication middleware in @apostrophecms/express/index.js (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using @apostrophecms/login-totp or any custom afterPasswordVerified login requirement.

Severity

The AC is High because the attacker must first obtain the victim's password. However, the entire purpose of MFA is to protect accounts when passwords are compromised (credential stuffing, phishing, database breaches), so this bypass negates the security control entirely.

Affected Versions

All versions of ApostropheCMS from 3.0.0 to 4.27.1, when used with @apostrophecms/login-totp or any custom afterPasswordVerified requirement.

Root Cause

In packages/apostrophe/modules/@apostrophecms/express/index.js, the getBearer() function (line 377) queries MongoDB for valid bearer tokens. The query at lines 386-389 is intended to only match tokens where the requirementsToVerify array is either absent (no MFA configured) or empty (all MFA requirements completed):

async function getBearer() {
    const bearer = await self.apos.login.bearerTokens.findOne({
        _id: req.token,
        expires: { $gte: new Date() },
        // requirementsToVerify array should be empty or inexistant
        // for the token to be usable to log in.
        $or: [
            { requirementsToVerify: { $exists: false } },
            { requirementsToVerify: { $ne: [] } }  // BUG
        ]
    });
    return bearer && bearer.userId;
}

The comment correctly states the intent: the array should be "empty or inexistant." However, the MongoDB operator $ne: [] matches documents where requirementsToVerify is NOT an empty array — meaning it matches tokens that still have unverified requirements. This is the exact opposite of the intended behavior.

Token State	`requirementsToVerify`	`$ne: []` result	Should match?
No MFA configured	(field absent)	N/A (`$exists: false` matches)	Yes
TOTP pending	`["AposTotp"]`	`true` (BUG!)	No
All verified	`[]`	`false` (BUG!)	Yes
Field removed (`$unset`)	(field absent)	N/A (`$exists: false` matches)	Yes

Attack Scenario

Prerequisites

ApostropheCMS instance with @apostrophecms/login-totp enabled
Attacker knows the victim's username and password (e.g., from credential stuffing, phishing, or a database breach)
Attacker does NOT know the victim's TOTP secret/code

Steps

Authenticate with password only: ``` POST /api/v1/@apostrophecms/login/login Content-Type: application/json

{"username": "admin", "password": "correct_password", "session": false} ```

Receive incomplete token (server correctly requires TOTP): json {"incompleteToken": "clxxxxxxxxxxxxxxxxxxxxxxxxx"}
Use incomplete token as bearer token (bypassing TOTP): GET /api/v1/@apostrophecms/page Authorization: Bearer clxxxxxxxxxxxxxxxxxxxxxxxxx
Full authenticated access granted. The bearer token middleware matches the token because requirementsToVerify: ["AposTotp"] satisfies $ne: []. The attacker has complete API access as the victim without ever providing a TOTP code.

Proof of Concept

See mfa-bypass-poc.js — demonstrates the query logic bug with all token states. Run:

#!/usr/bin/env node
/**
 * PoC: MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
 *
 * ApostropheCMS's bearer token middleware in @apostrophecms/express/index.js
 * has a logic error in the MongoDB query that validates bearer tokens.
 *
 * The comment says:
 *   "requirementsToVerify array should be empty or inexistant
 *    for the token to be usable to log in."
 *
 * But the actual query uses `$ne: []` (NOT equal to empty array),
 * which matches tokens WITH unverified requirements — the exact opposite
 * of the intended behavior.
 *
 * This allows an attacker who knows a user's password (but NOT their
 * TOTP code) to use the "incompleteToken" returned after password
 * verification as a fully authenticated bearer token, bypassing MFA.
 *
 * Affected: ApostropheCMS with @apostrophecms/login-totp (or any
 * custom afterPasswordVerified requirement)
 *
 * File: packages/apostrophe/modules/@apostrophecms/express/index.js:386-389
 */

const RED = '\x1b[91m';
const GREEN = '\x1b[92m';
const YELLOW = '\x1b[93m';
const CYAN = '\x1b[96m';
const RESET = '\x1b[0m';
const BOLD = '\x1b[1m';

// Simulate MongoDB's $ne operator behavior
function mongoNe(fieldValue, compareValue) {
  // MongoDB $ne: true if field value is NOT equal to compareValue
  // For arrays, MongoDB compares by value
  if (Array.isArray(fieldValue) && Array.isArray(compareValue)) {
    if (fieldValue.length !== compareValue.length) return true;
    return fieldValue.some((v, i) => v !== compareValue[i]);
  }
  return fieldValue !== compareValue;
}

// Simulate MongoDB's $exists operator
function mongoExists(doc, field, shouldExist) {
  const exists = field in doc;
  return exists === shouldExist;
}

// Simulate MongoDB's $size operator
function mongoSize(fieldValue, size) {
  if (!Array.isArray(fieldValue)) return false;
  return fieldValue.length === size;
}

// Simulate the VULNERABLE bearer token query (line 386-389)
function vulnerableQuery(token) {
  // $or: [
  //   { requirementsToVerify: { $exists: false } },
  //   { requirementsToVerify: { $ne: [] } }     <-- BUG
  // ]
  const cond1 = mongoExists(token, 'requirementsToVerify', false);
  const cond2 = ('requirementsToVerify' in token)
    ? mongoNe(token.requirementsToVerify, [])
    : false;
  return cond1 || cond2;
}

// Simulate the FIXED bearer token query
function fixedQuery(token) {
  // $or: [
  //   { requirementsToVerify: { $exists: false } },
  //   { requirementsToVerify: { $size: 0 } }    <-- FIX
  // ]
  const cond1 = mongoExists(token, 'requirementsToVerify', false);
  const cond2 = ('requirementsToVerify' in token)
    ? mongoSize(token.requirementsToVerify, 0)
    : false;
  return cond1 || cond2;
}

function banner() {
  console.log(`${CYAN}${BOLD}
╔══════════════════════════════════════════════════════════════════╗
║  ApostropheCMS MFA/TOTP Bypass PoC                              ║
║  Bearer Token Middleware — Incorrect MongoDB Query ($ne vs $eq)  ║
║  @apostrophecms/express/index.js:386-389                         ║
╚══════════════════════════════════════════════════════════════════╝${RESET}
`);
}

function test(name, token, expectedVuln, expectedFixed) {
  const vulnResult = vulnerableQuery(token);
  const fixedResult = fixedQuery(token);

  const vulnCorrect = vulnResult === expectedVuln;
  const fixedCorrect = fixedResult === expectedFixed;

  console.log(`${BOLD}${name}${RESET}`);
  console.log(`  Token: ${JSON.stringify(token)}`);
  console.log(`  Vulnerable query matches: ${vulnResult ? GREEN + 'YES' : RED + 'NO'}${RESET} (${vulnCorrect ? 'expected' : RED + 'UNEXPECTED!' + RESET})`);
  console.log(`  Fixed query matches:      ${fixedResult ? GREEN + 'YES' : RED + 'NO'}${RESET} (${fixedCorrect ? 'expected' : RED + 'UNEXPECTED!' + RESET})`);

  if (vulnResult && !fixedResult) {
    console.log(`  ${RED}=> BYPASS: Token accepted by vulnerable code but rejected by fix!${RESET}`);
  }
  console.log();
  return vulnResult && !fixedResult;
}

// ——— Main ———
banner();
const bypasses = [];

console.log(`${BOLD}--- Token States During Login Flow ---${RESET}\n`);

// 1. Normal bearer token (no MFA configured)
// Created by initialLogin when there are no lateRequirements
// Token: { _id: "xxx", userId: "yyy", expires: Date }
// No requirementsToVerify field at all
test(
  '[Token 1] Normal bearer token (no MFA) — should be ACCEPTED',
  { _id: 'token1', userId: 'user1', expires: new Date(Date.now() + 86400000) },
  true,  // vulnerable: accepted (correct)
  true   // fixed: accepted (correct)
);

// 2. Incomplete token — password verified, TOTP NOT verified
// Created by initialLogin when lateRequirements exist
// Token: { _id: "xxx", userId: "yyy", requirementsToVerify: ["AposTotp"], expires: Date }
const bypass1 = test(
  '[Token 2] Incomplete token (TOTP NOT verified) — should be REJECTED',
  { _id: 'token2', userId: 'user2', requirementsToVerify: ['AposTotp'], expires: new Date(Date.now() + 3600000) },
  true,  // vulnerable: ACCEPTED (BUG! $ne:[] matches ['AposTotp'])
  false  // fixed: rejected (correct)
);
if (bypass1) bypasses.push('TOTP bypass');

// 3. Token after all requirements verified (empty array, before $unset)
// After requirementVerify pulls each requirement from the array
// Token: { _id: "xxx", userId: "yyy", requirementsToVerify: [], expires: Date }
test(
  '[Token 3] All requirements verified (empty array) — should be ACCEPTED',
  { _id: 'token3', userId: 'user3', requirementsToVerify: [], expires: new Date(Date.now() + 86400000) },
  false, // vulnerable: REJECTED (BUG! $ne:[] does NOT match [])
  true   // fixed: accepted (correct)
);

// 4. Finalized token (requirementsToVerify removed via $unset)
// After finalizeIncompleteLogin calls $unset
// Token: { _id: "xxx", userId: "yyy", expires: Date }
test(
  '[Token 4] Finalized token ($unset completed) — should be ACCEPTED',
  { _id: 'token4', userId: 'user4', expires: new Date(Date.now() + 86400000) },
  true,  // vulnerable: accepted (correct)
  true   // fixed: accepted (correct)
);

// 5. Multiple unverified requirements
const bypass2 = test(
  '[Token 5] Multiple unverified requirements — should be REJECTED',
  { _id: 'token5', userId: 'user5', requirementsToVerify: ['AposTotp', 'CustomMFA'], expires: new Date(Date.now() + 3600000) },
  true,  // vulnerable: ACCEPTED (BUG!)
  false  // fixed: rejected (correct)
);
if (bypass2) bypasses.push('Multi-requirement bypass');

// Attack scenario
console.log(`${BOLD}--- Attack Scenario ---${RESET}\n`);
console.log(`  ${YELLOW}Prerequisites:${RESET}`);
console.log(`    - ApostropheCMS instance with @apostrophecms/login-totp enabled`);
console.log(`    - Attacker knows victim's username and password`);
console.log(`    - Attacker does NOT know victim's TOTP code\n`);

console.log(`  ${YELLOW}Step 1:${RESET} Attacker sends login request with valid credentials`);
console.log(`    POST /api/v1/@apostrophecms/login/login`);
console.log(`    {"username": "admin", "password": "correct_password", "session": false}\n`);

console.log(`  ${YELLOW}Step 2:${RESET} Server verifies password, returns incomplete token`);
console.log(`    Response: {"incompleteToken": "clxxxxxxxxxxxxxxxxxxxxxxxxx"}`);
console.log(`    (TOTP verification still required)\n`);

console.log(`  ${YELLOW}Step 3:${RESET} Attacker uses incompleteToken as a Bearer token`);
console.log(`    GET /api/v1/@apostrophecms/page`);
console.log(`    Authorization: Bearer clxxxxxxxxxxxxxxxxxxxxxxxxx\n`);

console.log(`  ${YELLOW}Step 4:${RESET} Bearer token middleware runs getBearer() query`);
console.log(`    MongoDB query: {`);
console.log(`      _id: "clxxxxxxxxxxxxxxxxxxxxxxxxx",`);
console.log(`      expires: { $gte: new Date() },`);
console.log(`      $or: [`);
console.log(`        { requirementsToVerify: { $exists: false } },`);
console.log(`        { requirementsToVerify: { ${RED}$ne: []${RESET} } }  // BUG!`);
console.log(`      ]`);
console.log(`    }`);
console.log(`    The token has requirementsToVerify: ["AposTotp"]`);
console.log(`    $ne: [] matches because ["AposTotp"] !== []\n`);

console.log(`  ${RED}Step 5: Attacker is fully authenticated as the victim!${RESET}`);
console.log(`    req.user is set, req.csrfExempt = true`);
console.log(`    Full API access without TOTP verification\n`);

// Summary
console.log(`${BOLD}${'='.repeat(64)}`);
console.log(`Summary`);
console.log(`${'='.repeat(64)}${RESET}`);
console.log(`  ${bypasses.length} bypass vector(s) confirmed: ${bypasses.join(', ')}\n`);
console.log(`  ${YELLOW}Root Cause:${RESET} @apostrophecms/express/index.js line 388`);
console.log(`  The MongoDB query uses $ne: [] which matches NON-empty arrays.`);
console.log(`  The comment says the array should be "empty or inexistant",`);
console.log(`  but $ne: [] matches exactly the opposite — non-empty arrays.\n`);
console.log(`  ${YELLOW}Vulnerable code:${RESET}`);
console.log(`    $or: [`);
console.log(`      { requirementsToVerify: { $exists: false } },`);
console.log(`      { requirementsToVerify: { $ne: [] } }  // BUG`);
console.log(`    ]\n`);
console.log(`  ${YELLOW}Fixed code:${RESET}`);
console.log(`    $or: [`);
console.log(`      { requirementsToVerify: { $exists: false } },`);
console.log(`      { requirementsToVerify: { $size: 0 } }  // FIX`);
console.log(`    ]\n`);
console.log(`  ${RED}Impact:${RESET} Complete MFA bypass. An attacker who knows a user's`);
console.log(`  password can skip TOTP verification and gain full authenticated`);
console.log(`  API access by using the incompleteToken as a bearer token.\n`);
console.log(`  ${YELLOW}Additional Bug:${RESET} The same $ne:[] also causes a secondary`);
console.log(`  issue where tokens with ALL requirements verified (empty array,`);
console.log(`  before the $unset runs) are incorrectly REJECTED. This is masked`);
console.log(`  by the fact that finalizeIncompleteLogin uses $unset to remove`);
console.log(`  the field entirely, so the $exists: false path is used instead.`);
console.log();
console.log();

Both bypass vectors (single and multiple unverified requirements) confirmed.

Amplifying Bug: Incorrect Token Deletion in `finalizeIncompleteLogin`

A second bug in @apostrophecms/login/index.js (lines 728-729, 735-736) amplifies the MFA bypass. When finalizeIncompleteLogin attempts to delete the incomplete token, it uses the wrong identifier:

await self.bearerTokens.removeOne({
    _id: token.userId  // BUG: should be token._id
});

The token's _id is a CUID (e.g., clxxxxxxxxx), but token.userId is the user's document ID. This means:

The incomplete token is never deleted from the database, even after a legitimate MFA-verified login
Combined with the $ne: [] bug, the incomplete token remains usable as a bearer token for its full lifetime (default: 1 hour)
Even if the legitimate user completes TOTP and logs in properly, the incomplete token persists

This bug appears at two locations in finalizeIncompleteLogin: - Line 728-729: Error case (user not found) - Line 735-736: Success case (session-based login after MFA)

Recommended Fix

Fix 1: Bearer token query (express/index.js line 388)

Replace $ne: [] with $size: 0:

$or: [
    { requirementsToVerify: { $exists: false } },
    { requirementsToVerify: { $size: 0 } }  // FIX: match empty array only
]

This ensures only tokens with no remaining requirements (empty array or absent field) are accepted as valid bearer tokens.

Fix 2: Token deletion (login/index.js lines 728-729, 735-736)

Replace token.userId with token._id:

await self.bearerTokens.removeOne({
    _id: token._id  // FIX: use the token's actual ID
});

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.27.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "apostrophe"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.28.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32730"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-305"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-18T19:48:51Z",
    "nvd_published_at": "2026-03-18T23:17:29Z",
    "severity": "HIGH"
  },
  "details": "# MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware\n\n## Summary\n\nThe bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens \u2014 where the password was verified but TOTP/MFA requirements were NOT \u2014 to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using `@apostrophecms/login-totp` or any custom `afterPasswordVerified` login requirement.\n\n## Severity\n\nThe AC is High because the attacker must first obtain the victim\u0027s password. However, the entire purpose of MFA is to protect accounts when passwords are compromised (credential stuffing, phishing, database breaches), so this bypass negates the security control entirely.\n\n## Affected Versions\n\nAll versions of ApostropheCMS from 3.0.0 to 4.27.1, when used with `@apostrophecms/login-totp` or any custom `afterPasswordVerified` requirement.\n\n## Root Cause\n\nIn `packages/apostrophe/modules/@apostrophecms/express/index.js`, the `getBearer()` function (line 377) queries MongoDB for valid bearer tokens. The query at lines 386-389 is intended to only match tokens where the `requirementsToVerify` array is either absent (no MFA configured) or empty (all MFA requirements completed):\n\n```javascript\nasync function getBearer() {\n    const bearer = await self.apos.login.bearerTokens.findOne({\n        _id: req.token,\n        expires: { $gte: new Date() },\n        // requirementsToVerify array should be empty or inexistant\n        // for the token to be usable to log in.\n        $or: [\n            { requirementsToVerify: { $exists: false } },\n            { requirementsToVerify: { $ne: [] } }  // BUG\n        ]\n    });\n    return bearer \u0026\u0026 bearer.userId;\n}\n```\n\nThe comment correctly states the intent: the array should be \"empty or inexistant.\" However, the MongoDB operator `$ne: []` matches documents where `requirementsToVerify` is **NOT** an empty array \u2014 meaning it matches tokens that still have **unverified requirements**. This is the exact opposite of the intended behavior.\n\n| Token State | `requirementsToVerify` | `$ne: []` result | Should match? |\n|---|---|---|---|\n| No MFA configured | *(field absent)* | N/A (`$exists: false` matches) | Yes |\n| TOTP pending | `[\"AposTotp\"]` | `true` (BUG!) | **No** |\n| All verified | `[]` | `false` (BUG!) | **Yes** |\n| Field removed (`$unset`) | *(field absent)* | N/A (`$exists: false` matches) | Yes |\n\n## Attack Scenario\n\n### Prerequisites\n- ApostropheCMS instance with `@apostrophecms/login-totp` enabled\n- Attacker knows the victim\u0027s username and password (e.g., from credential stuffing, phishing, or a database breach)\n- Attacker does NOT know the victim\u0027s TOTP secret/code\n\n### Steps\n\n1. **Authenticate with password only:**\n   ```\n   POST /api/v1/@apostrophecms/login/login\n   Content-Type: application/json\n\n   {\"username\": \"admin\", \"password\": \"correct_password\", \"session\": false}\n   ```\n\n2. **Receive incomplete token** (server correctly requires TOTP):\n   ```json\n   {\"incompleteToken\": \"clxxxxxxxxxxxxxxxxxxxxxxxxx\"}\n   ```\n\n3. **Use incomplete token as bearer token** (bypassing TOTP):\n   ```\n   GET /api/v1/@apostrophecms/page\n   Authorization: Bearer clxxxxxxxxxxxxxxxxxxxxxxxxx\n   ```\n\n4. **Full authenticated access granted.** The bearer token middleware matches the token because `requirementsToVerify: [\"AposTotp\"]` satisfies `$ne: []`. The attacker has complete API access as the victim without ever providing a TOTP code.\n\n## Proof of Concept\n\nSee `mfa-bypass-poc.js` \u2014 demonstrates the query logic bug with all token states. Run:\n\n```bash\n#!/usr/bin/env node\n/**\n * PoC: MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware\n *\n * ApostropheCMS\u0027s bearer token middleware in @apostrophecms/express/index.js\n * has a logic error in the MongoDB query that validates bearer tokens.\n *\n * The comment says:\n *   \"requirementsToVerify array should be empty or inexistant\n *    for the token to be usable to log in.\"\n *\n * But the actual query uses `$ne: []` (NOT equal to empty array),\n * which matches tokens WITH unverified requirements \u2014 the exact opposite\n * of the intended behavior.\n *\n * This allows an attacker who knows a user\u0027s password (but NOT their\n * TOTP code) to use the \"incompleteToken\" returned after password\n * verification as a fully authenticated bearer token, bypassing MFA.\n *\n * Affected: ApostropheCMS with @apostrophecms/login-totp (or any\n * custom afterPasswordVerified requirement)\n *\n * File: packages/apostrophe/modules/@apostrophecms/express/index.js:386-389\n */\n\nconst RED = \u0027\\x1b[91m\u0027;\nconst GREEN = \u0027\\x1b[92m\u0027;\nconst YELLOW = \u0027\\x1b[93m\u0027;\nconst CYAN = \u0027\\x1b[96m\u0027;\nconst RESET = \u0027\\x1b[0m\u0027;\nconst BOLD = \u0027\\x1b[1m\u0027;\n\n// Simulate MongoDB\u0027s $ne operator behavior\nfunction mongoNe(fieldValue, compareValue) {\n  // MongoDB $ne: true if field value is NOT equal to compareValue\n  // For arrays, MongoDB compares by value\n  if (Array.isArray(fieldValue) \u0026\u0026 Array.isArray(compareValue)) {\n    if (fieldValue.length !== compareValue.length) return true;\n    return fieldValue.some((v, i) =\u003e v !== compareValue[i]);\n  }\n  return fieldValue !== compareValue;\n}\n\n// Simulate MongoDB\u0027s $exists operator\nfunction mongoExists(doc, field, shouldExist) {\n  const exists = field in doc;\n  return exists === shouldExist;\n}\n\n// Simulate MongoDB\u0027s $size operator\nfunction mongoSize(fieldValue, size) {\n  if (!Array.isArray(fieldValue)) return false;\n  return fieldValue.length === size;\n}\n\n// Simulate the VULNERABLE bearer token query (line 386-389)\nfunction vulnerableQuery(token) {\n  // $or: [\n  //   { requirementsToVerify: { $exists: false } },\n  //   { requirementsToVerify: { $ne: [] } }     \u003c-- BUG\n  // ]\n  const cond1 = mongoExists(token, \u0027requirementsToVerify\u0027, false);\n  const cond2 = (\u0027requirementsToVerify\u0027 in token)\n    ? mongoNe(token.requirementsToVerify, [])\n    : false;\n  return cond1 || cond2;\n}\n\n// Simulate the FIXED bearer token query\nfunction fixedQuery(token) {\n  // $or: [\n  //   { requirementsToVerify: { $exists: false } },\n  //   { requirementsToVerify: { $size: 0 } }    \u003c-- FIX\n  // ]\n  const cond1 = mongoExists(token, \u0027requirementsToVerify\u0027, false);\n  const cond2 = (\u0027requirementsToVerify\u0027 in token)\n    ? mongoSize(token.requirementsToVerify, 0)\n    : false;\n  return cond1 || cond2;\n}\n\nfunction banner() {\n  console.log(`${CYAN}${BOLD}\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n\u2551  ApostropheCMS MFA/TOTP Bypass PoC                              \u2551\n\u2551  Bearer Token Middleware \u2014 Incorrect MongoDB Query ($ne vs $eq)  \u2551\n\u2551  @apostrophecms/express/index.js:386-389                         \u2551\n\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d${RESET}\n`);\n}\n\nfunction test(name, token, expectedVuln, expectedFixed) {\n  const vulnResult = vulnerableQuery(token);\n  const fixedResult = fixedQuery(token);\n\n  const vulnCorrect = vulnResult === expectedVuln;\n  const fixedCorrect = fixedResult === expectedFixed;\n\n  console.log(`${BOLD}${name}${RESET}`);\n  console.log(`  Token: ${JSON.stringify(token)}`);\n  console.log(`  Vulnerable query matches: ${vulnResult ? GREEN + \u0027YES\u0027 : RED + \u0027NO\u0027}${RESET} (${vulnCorrect ? \u0027expected\u0027 : RED + \u0027UNEXPECTED!\u0027 + RESET})`);\n  console.log(`  Fixed query matches:      ${fixedResult ? GREEN + \u0027YES\u0027 : RED + \u0027NO\u0027}${RESET} (${fixedCorrect ? \u0027expected\u0027 : RED + \u0027UNEXPECTED!\u0027 + RESET})`);\n\n  if (vulnResult \u0026\u0026 !fixedResult) {\n    console.log(`  ${RED}=\u003e BYPASS: Token accepted by vulnerable code but rejected by fix!${RESET}`);\n  }\n  console.log();\n  return vulnResult \u0026\u0026 !fixedResult;\n}\n\n// \u2014\u2014\u2014 Main \u2014\u2014\u2014\nbanner();\nconst bypasses = [];\n\nconsole.log(`${BOLD}--- Token States During Login Flow ---${RESET}\\n`);\n\n// 1. Normal bearer token (no MFA configured)\n// Created by initialLogin when there are no lateRequirements\n// Token: { _id: \"xxx\", userId: \"yyy\", expires: Date }\n// No requirementsToVerify field at all\ntest(\n  \u0027[Token 1] Normal bearer token (no MFA) \u2014 should be ACCEPTED\u0027,\n  { _id: \u0027token1\u0027, userId: \u0027user1\u0027, expires: new Date(Date.now() + 86400000) },\n  true,  // vulnerable: accepted (correct)\n  true   // fixed: accepted (correct)\n);\n\n// 2. Incomplete token \u2014 password verified, TOTP NOT verified\n// Created by initialLogin when lateRequirements exist\n// Token: { _id: \"xxx\", userId: \"yyy\", requirementsToVerify: [\"AposTotp\"], expires: Date }\nconst bypass1 = test(\n  \u0027[Token 2] Incomplete token (TOTP NOT verified) \u2014 should be REJECTED\u0027,\n  { _id: \u0027token2\u0027, userId: \u0027user2\u0027, requirementsToVerify: [\u0027AposTotp\u0027], expires: new Date(Date.now() + 3600000) },\n  true,  // vulnerable: ACCEPTED (BUG! $ne:[] matches [\u0027AposTotp\u0027])\n  false  // fixed: rejected (correct)\n);\nif (bypass1) bypasses.push(\u0027TOTP bypass\u0027);\n\n// 3. Token after all requirements verified (empty array, before $unset)\n// After requirementVerify pulls each requirement from the array\n// Token: { _id: \"xxx\", userId: \"yyy\", requirementsToVerify: [], expires: Date }\ntest(\n  \u0027[Token 3] All requirements verified (empty array) \u2014 should be ACCEPTED\u0027,\n  { _id: \u0027token3\u0027, userId: \u0027user3\u0027, requirementsToVerify: [], expires: new Date(Date.now() + 86400000) },\n  false, // vulnerable: REJECTED (BUG! $ne:[] does NOT match [])\n  true   // fixed: accepted (correct)\n);\n\n// 4. Finalized token (requirementsToVerify removed via $unset)\n// After finalizeIncompleteLogin calls $unset\n// Token: { _id: \"xxx\", userId: \"yyy\", expires: Date }\ntest(\n  \u0027[Token 4] Finalized token ($unset completed) \u2014 should be ACCEPTED\u0027,\n  { _id: \u0027token4\u0027, userId: \u0027user4\u0027, expires: new Date(Date.now() + 86400000) },\n  true,  // vulnerable: accepted (correct)\n  true   // fixed: accepted (correct)\n);\n\n// 5. Multiple unverified requirements\nconst bypass2 = test(\n  \u0027[Token 5] Multiple unverified requirements \u2014 should be REJECTED\u0027,\n  { _id: \u0027token5\u0027, userId: \u0027user5\u0027, requirementsToVerify: [\u0027AposTotp\u0027, \u0027CustomMFA\u0027], expires: new Date(Date.now() + 3600000) },\n  true,  // vulnerable: ACCEPTED (BUG!)\n  false  // fixed: rejected (correct)\n);\nif (bypass2) bypasses.push(\u0027Multi-requirement bypass\u0027);\n\n// Attack scenario\nconsole.log(`${BOLD}--- Attack Scenario ---${RESET}\\n`);\nconsole.log(`  ${YELLOW}Prerequisites:${RESET}`);\nconsole.log(`    - ApostropheCMS instance with @apostrophecms/login-totp enabled`);\nconsole.log(`    - Attacker knows victim\u0027s username and password`);\nconsole.log(`    - Attacker does NOT know victim\u0027s TOTP code\\n`);\n\nconsole.log(`  ${YELLOW}Step 1:${RESET} Attacker sends login request with valid credentials`);\nconsole.log(`    POST /api/v1/@apostrophecms/login/login`);\nconsole.log(`    {\"username\": \"admin\", \"password\": \"correct_password\", \"session\": false}\\n`);\n\nconsole.log(`  ${YELLOW}Step 2:${RESET} Server verifies password, returns incomplete token`);\nconsole.log(`    Response: {\"incompleteToken\": \"clxxxxxxxxxxxxxxxxxxxxxxxxx\"}`);\nconsole.log(`    (TOTP verification still required)\\n`);\n\nconsole.log(`  ${YELLOW}Step 3:${RESET} Attacker uses incompleteToken as a Bearer token`);\nconsole.log(`    GET /api/v1/@apostrophecms/page`);\nconsole.log(`    Authorization: Bearer clxxxxxxxxxxxxxxxxxxxxxxxxx\\n`);\n\nconsole.log(`  ${YELLOW}Step 4:${RESET} Bearer token middleware runs getBearer() query`);\nconsole.log(`    MongoDB query: {`);\nconsole.log(`      _id: \"clxxxxxxxxxxxxxxxxxxxxxxxxx\",`);\nconsole.log(`      expires: { $gte: new Date() },`);\nconsole.log(`      $or: [`);\nconsole.log(`        { requirementsToVerify: { $exists: false } },`);\nconsole.log(`        { requirementsToVerify: { ${RED}$ne: []${RESET} } }  // BUG!`);\nconsole.log(`      ]`);\nconsole.log(`    }`);\nconsole.log(`    The token has requirementsToVerify: [\"AposTotp\"]`);\nconsole.log(`    $ne: [] matches because [\"AposTotp\"] !== []\\n`);\n\nconsole.log(`  ${RED}Step 5: Attacker is fully authenticated as the victim!${RESET}`);\nconsole.log(`    req.user is set, req.csrfExempt = true`);\nconsole.log(`    Full API access without TOTP verification\\n`);\n\n// Summary\nconsole.log(`${BOLD}${\u0027=\u0027.repeat(64)}`);\nconsole.log(`Summary`);\nconsole.log(`${\u0027=\u0027.repeat(64)}${RESET}`);\nconsole.log(`  ${bypasses.length} bypass vector(s) confirmed: ${bypasses.join(\u0027, \u0027)}\\n`);\nconsole.log(`  ${YELLOW}Root Cause:${RESET} @apostrophecms/express/index.js line 388`);\nconsole.log(`  The MongoDB query uses $ne: [] which matches NON-empty arrays.`);\nconsole.log(`  The comment says the array should be \"empty or inexistant\",`);\nconsole.log(`  but $ne: [] matches exactly the opposite \u2014 non-empty arrays.\\n`);\nconsole.log(`  ${YELLOW}Vulnerable code:${RESET}`);\nconsole.log(`    $or: [`);\nconsole.log(`      { requirementsToVerify: { $exists: false } },`);\nconsole.log(`      { requirementsToVerify: { $ne: [] } }  // BUG`);\nconsole.log(`    ]\\n`);\nconsole.log(`  ${YELLOW}Fixed code:${RESET}`);\nconsole.log(`    $or: [`);\nconsole.log(`      { requirementsToVerify: { $exists: false } },`);\nconsole.log(`      { requirementsToVerify: { $size: 0 } }  // FIX`);\nconsole.log(`    ]\\n`);\nconsole.log(`  ${RED}Impact:${RESET} Complete MFA bypass. An attacker who knows a user\u0027s`);\nconsole.log(`  password can skip TOTP verification and gain full authenticated`);\nconsole.log(`  API access by using the incompleteToken as a bearer token.\\n`);\nconsole.log(`  ${YELLOW}Additional Bug:${RESET} The same $ne:[] also causes a secondary`);\nconsole.log(`  issue where tokens with ALL requirements verified (empty array,`);\nconsole.log(`  before the $unset runs) are incorrectly REJECTED. This is masked`);\nconsole.log(`  by the fact that finalizeIncompleteLogin uses $unset to remove`);\nconsole.log(`  the field entirely, so the $exists: false path is used instead.`);\nconsole.log();\nconsole.log();\n\n```\n\nBoth bypass vectors (single and multiple unverified requirements) confirmed.\n\n## Amplifying Bug: Incorrect Token Deletion in `finalizeIncompleteLogin`\n\nA second bug in `@apostrophecms/login/index.js` (lines 728-729, 735-736) amplifies the MFA bypass. When `finalizeIncompleteLogin` attempts to delete the incomplete token, it uses the wrong identifier:\n\n```javascript\nawait self.bearerTokens.removeOne({\n    _id: token.userId  // BUG: should be token._id\n});\n```\n\nThe token\u0027s `_id` is a CUID (e.g., `clxxxxxxxxx`), but `token.userId` is the user\u0027s document ID. This means:\n\n1. The incomplete token is **never deleted** from the database, even after a legitimate MFA-verified login\n2. Combined with the `$ne: []` bug, the incomplete token remains usable as a bearer token for its full lifetime (default: 1 hour)\n3. Even if the legitimate user completes TOTP and logs in properly, the incomplete token persists\n\nThis bug appears at two locations in `finalizeIncompleteLogin`:\n- Line 728-729: Error case (user not found)\n- Line 735-736: Success case (session-based login after MFA)\n\n## Recommended Fix\n\n### Fix 1: Bearer token query (express/index.js line 388)\n\nReplace `$ne: []` with `$size: 0`:\n\n```javascript\n$or: [\n    { requirementsToVerify: { $exists: false } },\n    { requirementsToVerify: { $size: 0 } }  // FIX: match empty array only\n]\n```\n\nThis ensures only tokens with no remaining requirements (empty array or absent field) are accepted as valid bearer tokens.\n\n### Fix 2: Token deletion (login/index.js lines 728-729, 735-736)\n\nReplace `token.userId` with `token._id`:\n\n```javascript\nawait self.bearerTokens.removeOne({\n    _id: token._id  // FIX: use the token\u0027s actual ID\n});\n```",
  "id": "GHSA-v9xm-ffx2-7h35",
  "modified": "2026-03-19T21:14:07Z",
  "published": "2026-03-18T19:48:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-v9xm-ffx2-7h35"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32730"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apostrophecms/apostrophe"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware"
}

GHSA-V9XQ-2MVM-X8XC

Vulnerability from github – Published: 2024-10-28 19:44 – Updated: 2024-10-28 21:49

Summary

Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs

Details

Impact

IdentityServer's local API authentication handler performs insufficient validation of the cnf claim in DPoP access tokens. This allows an attacker to use leaked DPoP access tokens at local api endpoints even without possessing the private key for signing proof tokens.

Note that this only impacts custom endpoints within an IdentityServer implementation that have explicitly used the LocalApiAuthenticationHandler for authentication. It does not impact: - OAuth or OIDC protocol endpoints defined by IdentityServer, such as the authorize and token endpoints. - Typical UI pages within an IdentityServer implementation, which are not normally authorized with the local API authentication handler. - The use of DPoP to create sender-constrained tokens in IdentityServer that are consumed by external API resources. - The use of DPoP to sender-constrain refresh tokens issued to public clients.

Are you affected?

This vulnerability only affects IdentityServer implementations that are using the local APIs feature of IdentityServer and have explicitly enabled DPoP for local APIs. The local api authentication handler is configured with a call to either AddLocalApi or AddLocalApiAuthentication, and the opt-in to DPoP for local APIs is enabled via the TokenMode option.

Vulnerable implementations of IdentityServer would have configuration code similar to the following:

services.AddAuthentication()
    .AddLocalApi("local", options => 
    {
        options.TokenMode = LocalApiTokenMode.DPoPAndBearer; // or LocalApiTokenMode.DPoPOnly
    });

Patches

This vulnerability is patched in IdentityServer 7.0.8. Version 6.3 and below are unaffected, as they do not support DPoP in Local APIs.

Severity

3.1 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

2.1 (Low)


                  
                    CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Duende.IdentityServer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-49755"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-28T19:44:10Z",
    "nvd_published_at": "2024-10-28T20:15:06Z",
    "severity": "LOW"
  },
  "details": "### Impact\nIdentityServer\u0027s local API authentication handler performs insufficient validation of the `cnf` claim in DPoP access tokens. This allows an attacker to use leaked DPoP access tokens at local api endpoints even without possessing the private key for signing proof tokens.\n\nNote that this only impacts custom endpoints within an IdentityServer implementation that have explicitly used the `LocalApiAuthenticationHandler` for authentication. It does not impact:\n- OAuth or OIDC protocol endpoints defined by IdentityServer, such as the authorize and token endpoints.\n- Typical UI pages within an IdentityServer implementation, which are not normally authorized with the local API authentication handler.\n- The use of DPoP to create sender-constrained tokens in IdentityServer that are consumed by external API resources.\n- The use of DPoP to sender-constrain refresh tokens issued to public clients.\n\n## Are you affected?\n\nThis vulnerability only affects IdentityServer implementations that are using the local APIs feature of IdentityServer and have explicitly enabled DPoP for local APIs. The local api authentication handler is configured with a call to either `AddLocalApi` or `AddLocalApiAuthentication`, and the opt-in to DPoP for local APIs is enabled via the `TokenMode` option. \n\nVulnerable implementations of IdentityServer would have configuration code similar to the following:\n\n```cs\nservices.AddAuthentication()\n    .AddLocalApi(\"local\", options =\u003e \n    {\n        options.TokenMode = LocalApiTokenMode.DPoPAndBearer; // or LocalApiTokenMode.DPoPOnly\n    });\n```\n\n### Patches\nThis vulnerability is patched in IdentityServer 7.0.8. Version 6.3 and below are unaffected, as they do not support DPoP in Local APIs.\n",
  "id": "GHSA-v9xq-2mvm-x8xc",
  "modified": "2024-10-28T21:49:51Z",
  "published": "2024-10-28T19:44:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-v9xq-2mvm-x8xc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49755"
    },
    {
      "type": "WEB",
      "url": "https://github.com/DuendeSoftware/IdentityServer/commit/f28cac921c1f545afe65af71a9327224755b6dac"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/DuendeSoftware/IdentityServer"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs "
}

GHSA-VC4M-X7GG-XQPC

Vulnerability from github – Published: 2024-07-12 15:31 – Updated: 2024-09-23 15:31

Details

Securepoint UTM before 12.6.5 mishandles OTP codes.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-39340"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-12T13:15:12Z",
    "severity": "HIGH"
  },
  "details": "Securepoint UTM before 12.6.5 mishandles OTP codes.",
  "id": "GHSA-vc4m-x7gg-xqpc",
  "modified": "2024-09-23T15:31:00Z",
  "published": "2024-07-12T15:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39340"
    },
    {
      "type": "WEB",
      "url": "https://wiki.securepoint.de/Advisory/CVE-2024-39340"
    },
    {
      "type": "WEB",
      "url": "https://wiki.securepoint.de/UTM/Changelog"
    },
    {
      "type": "WEB",
      "url": "https://www.securepoint.de/en/for-companies/utm-firewall"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VC6M-JRWW-32FP

Vulnerability from github – Published: 2022-05-17 03:37 – Updated: 2022-05-17 03:37

Details

The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 allows remote attackers to obtain sensitive information via crafted SCP messages, aka Bug ID CSCuv35694.

Severity

7.5 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2016-1427"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-06-18T01:59:00Z",
    "severity": "HIGH"
  },
  "details": "The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 allows remote attackers to obtain sensitive information via crafted SCP messages, aka Bug ID CSCuv35694.",
  "id": "GHSA-vc6m-jrww-32fp",
  "modified": "2022-05-17T03:37:39Z",
  "published": "2022-05-17T03:37:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1427"
    },
    {
      "type": "WEB",
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160616-pnr"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1036128"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VC7J-H8XG-FV5X

Vulnerability from github – Published: 2023-08-04 17:26 – Updated: 2023-08-04 17:26

Summary

matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs

Details

Impact

A malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API.

Details

The library does not check that the servername part of the sub parameter (containing the user's claimed MXID) is the same as the servername we are talking to. A malicious actor could spin up a server on any given domain, respond with a sub parameter according to the user they want to act as and use the resulting token to perform provisioning requests.

Workarounds

Disable the provisioning API. If the bridge does not use the provisioning API, you are not vulnerable.

Severity

5.0 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "matrix-appservice-bridge"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "8.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "matrix-appservice-bridge"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.0.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2023-38691"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-04T17:26:32Z",
    "nvd_published_at": "2023-08-04T17:15:11Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nA malicious Matrix server can use a foreign user\u0027s MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API.\n\n### Details\n\nThe library does not check that the servername part of the `sub` parameter (containing the user\u0027s *claimed* MXID) is the same as the servername we are talking to. A malicious actor could spin up a server on any given domain, respond with a `sub` parameter according to the user they want to act as and use the resulting token to perform provisioning requests.\n\n### Workarounds\n\nDisable the provisioning API. If the bridge does not use the provisioning API, you are not vulnerable.\n",
  "id": "GHSA-vc7j-h8xg-fv5x",
  "modified": "2023-08-04T17:26:32Z",
  "published": "2023-08-04T17:26:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-vc7j-h8xg-fv5x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38691"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/matrix-appservice-bridge/commit/4c6723a5e7beda65cdf1ae5dbb882e8beaac8552"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/matrix-org/matrix-appservice-bridge"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "matrix-appservice-bridge doesn\u0027t verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs"
}

GHSA-VC85-2PC3-GRVJ

Vulnerability from github – Published: 2022-05-14 01:37 – Updated: 2022-05-14 01:37

Details

The Stripe API v1 allows remote attackers to bypass intended access restrictions by replaying api.stripe.com /v1/tokens XMLHttpRequest data, parsing the response under the object card{}, and reading the cvc_check information if the creation is successful without charging the actual card used in the transaction.

Severity

7.5 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-19249"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-01-03T22:29:00Z",
    "severity": "HIGH"
  },
  "details": "The Stripe API v1 allows remote attackers to bypass intended access restrictions by replaying api.stripe.com /v1/tokens XMLHttpRequest data, parsing the response under the object card{}, and reading the cvc_check information if the creation is successful without charging the actual card used in the transaction.",
  "id": "GHSA-vc85-2pc3-grvj",
  "modified": "2022-05-14T01:37:56Z",
  "published": "2022-05-14T01:37:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19249"
    },
    {
      "type": "WEB",
      "url": "https://fredmooredamian.blogspot.com/2019/01/improper-authentication-on-stripe-api-v1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VCF3-26XF-FW4M

Vulnerability from github – Published: 2026-01-30 21:30 – Updated: 2026-02-01 18:09

Summary

Salt Authentication Protocol Version Downgrade Allows Minion Impersonation

Details

Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to prior issues.

Severity

6.2 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L

7.5 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "salt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3006.12"
            },
            {
              "fixed": "3006.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "salt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3007.4"
            },
            {
              "fixed": "3007.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-62349"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-01T18:09:41Z",
    "nvd_published_at": "2026-01-30T19:16:11Z",
    "severity": "HIGH"
  },
  "details": "Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to prior issues.",
  "id": "GHSA-vcf3-26xf-fw4m",
  "modified": "2026-02-01T18:09:41Z",
  "published": "2026-01-30T21:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62349"
    },
    {
      "type": "WEB",
      "url": "https://github.com/saltstack/salt/issues/68467"
    },
    {
      "type": "WEB",
      "url": "https://github.com/saltstack/salt/commit/3d5708acae16d039a1e2b5529c8e14a0d3255611"
    },
    {
      "type": "WEB",
      "url": "https://docs.saltproject.io/en/latest/topics/releases/3006.17.html"
    },
    {
      "type": "WEB",
      "url": "https://docs.saltproject.io/en/latest/topics/releases/3007.9.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/saltstack/salt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Salt Authentication Protocol Version Downgrade Allows Minion Impersonation"
}

Mitigation

Architecture and Design

Strategy: Libraries or Frameworks

Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

CAPEC-114: Authentication Abuse

An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.

CAPEC-115: Authentication Bypass

An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.

CAPEC-151: Identity Spoofing

Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.

CAPEC-194: Fake the Source of Data

An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.

CAPEC-22: Exploiting Trust in Client

An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.

CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data

This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.

CAPEC-593: Session Hijacking

This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.

CAPEC-633: Token Impersonation

An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.

CAPEC-650: Upload a Web Shell to a Web Server

By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.

CAPEC-94: Adversary in the Middle (AiTM)

An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.

← Back to the CWE list

CWE-287

Improper Authentication

Impact

Patches

References

Reporter

MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

Summary

Severity

Affected Versions

Root Cause

Attack Scenario

Prerequisites

Steps

Proof of Concept

Amplifying Bug: Incorrect Token Deletion in finalizeIncompleteLogin

Recommended Fix

Fix 1: Bearer token query (express/index.js line 388)

Fix 2: Token deletion (login/index.js lines 728-729, 735-736)

Impact

Are you affected?

Patches

Impact

Details

Workarounds

Mitigation

CAPEC-114: Authentication Abuse

CAPEC-115: Authentication Bypass

CAPEC-151: Identity Spoofing

CAPEC-194: Fake the Source of Data

CAPEC-22: Exploiting Trust in Client

CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data

CAPEC-593: Session Hijacking

CAPEC-633: Token Impersonation

CAPEC-650: Upload a Web Shell to a Web Server

CAPEC-94: Adversary in the Middle (AiTM)

Amplifying Bug: Incorrect Token Deletion in `finalizeIncompleteLogin`