CVE-2024-34065

Strapi is an open-source content management system. By combining two vulnerabilities an "Open Redirect" and "session token sent as URL query parameter" in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and...

CVE-2024-34065: Authentication Bypass by Capture-replay

Strapi is an open-source content management system. By combining two vulnerabilities an Open Redirect and session token sent as URL query parameter in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and...