AIKIDO-2024-10081
oauth4webapi is vulnerable to Authentication Bypass by Capture-replay
15
Low Risk
This Affects:
oauth4webapiTL;DR
Affected versions of the oauth4webapi library are vulnerable to authentication bypass by capture-replay because the DPoP (demonstrating proof of possession) iat (issued at) timestamp is not checked. This flaw allows a malicious user to sniff network traffic and bypass authentication by replaying the captured message to the server, achieving the same effect as the original request (or with minimal changes).
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
oauth4webapi is vulnerable to Authentication Bypass by Capture-replay in versions 2.8.0 - 2.8.0.
How to fix this
Upgrade the oauth4webapi library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant