CVE-2024-21494

🗓️ 17 Feb 2024 05:00:07Reported by snykType

cve🔗 web.nvd.nist.gov👁 155 Views🌐 WEB

All versions of github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via X-Forwarded-For header

Reporter	Title	Published	Views	Family All 17
Circl	CVE-2024-21494	17 Feb 202406:21	–	circl
CNNVD	Caddy Security Breach	17 Feb 202400:00	–	cnnvd
Cvelist	CVE-2024-21494	17 Feb 202405:00	–	cvelist
EUVD	EUVD-2024-0735	3 Oct 202520:07	–	euvd
Github Security Blog	Authentication Bypass by Spoofing in github.com/greenpau/caddy-security	17 Feb 202406:30	–	github
Mend	CVE-2024-21494	17 Feb 202405:00	–	mend
NVD	CVE-2024-21494	17 Feb 202405:15	–	nvd
osv_cve	CVE-2024-21494	17 Feb 202405:15	–	osv_cve
osv_ghsa	GHSA-VJ36-3CCR-6563 Authentication Bypass by Spoofing in github.com/greenpau/caddy-security	17 Feb 202406:30	–	osv_ghsa
osv_go	GO-2024-2558 Authentication Bypass by Spoofing in github.com/greenpau/caddy-security	28 Jun 202415:28	–	osv_go

NVD

Vulners

Vulnrichment

Node

greenpau caddy-security

[
  {
    "product": "github.com/greenpau/caddy-security",
    "versions": [
      {
        "version": "0",
        "lessThan": "*",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]

Source	Link
github	www.github.com/greenpau/caddy-security/issues/266
blog	www.blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
security	www.security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249859

Parameter	Position	Path	Description	CWE
X-Forwarded-For	header	/whoami	Authentication Bypass by Spoofing via the X-Forwarded-For header due to improper input sanitization in the /whoami API endpoint.	CWE-290, CWE-79

17 Jun 2026 07:09Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.15.4

EPSS0.00519

SSVC