CVE-2024-56325

🗓️ 01 Apr 2025 09:07:14Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 599 Views🌐 WEB

Authentication bypass allows unauthorized user addition, compromising system control.

Reporter	Title	Published	Views	Family All 24
BDU FSTEC	The vulnerability of the AuthenticationFilter class in the Apache Pinot OLAP data store allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.	19 Mar 202500:00	–	bdu_fstec
Circl	CVE-2024-56325	3 Mar 202505:00	–	circl
CNNVD	Apache Pinot 安全漏洞	1 Apr 202500:00	–	cnnvd
Cvelist	CVE-2024-56325 Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required	1 Apr 202509:07	–	cvelist
EUVD	EUVD-2025-9317	3 Oct 202520:07	–	euvd
Github Security Blog	Apache Pinot Vulnerable to Authentication Bypass	1 Apr 202509:30	–	github
Nuclei	Apache Pinot < 1.3.0 - Authentication Bypass	20 Jul 202605:01	–	nuclei
NVD	CVE-2024-56325	1 Apr 202509:15	–	nvd
OSV	CVE-2024-56325 Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required	1 Apr 202509:07	–	osv
OSV	GHSA-6JWP-4WVJ-6597 Apache Pinot Vulnerable to Authentication Bypass	1 Apr 202509:30	–	osv

NVD

Vulners

Node

apache pinotRange<1.3.0

[
  {
    "defaultStatus": "unaffected",
    "packageName": "org.apache.pinot.controller.api",
    "product": "Apache Pinot",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "1.3",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/ksf8qsndr1h66otkbjz2wrzsbw992r8v
openwall	www.openwall.com/lists/oss-security/2025/03/27/8

Parameter	Position	Path	Description	CWE
username	request body	/users	Bypass authentication on /users via crafted JSON payload to create a new user without proper authentication (CVE-2024-56325).	CWE-288
password	request body	/users	Bypass authentication on /users via crafted JSON payload to create a new user without proper authentication (CVE-2024-56325).	CWE-288
component	request body	/users	Bypass authentication on /users via crafted JSON payload to create a new user without proper authentication (CVE-2024-56325).	CWE-288
role	request body	/users	Bypass authentication on /users via crafted JSON payload to create a new user without proper authentication (CVE-2024-56325).	CWE-288
tables	request body	/users	Bypass authentication on /users via crafted JSON payload to create a new user without proper authentication (CVE-2024-56325).	CWE-288
permissions	request body	/users	Bypass authentication on /users via crafted JSON payload to create a new user without proper authentication (CVE-2024-56325).	CWE-288
usernameWithComponent	request body	/users	Bypass authentication on /users via crafted JSON payload to create a new user without proper authentication (CVE-2024-56325).	CWE-288

17 Jun 2026 08:12Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

EPSS0.78668

SSVC

CWE-288