vantage6-node (3.4.1), vantage6-server (3.4.1) potentially affected by CVE-2024-24770 via vantage6 (3.4.1)

vantage6 PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.4.1 - vantage6-server 3.4.1 Source cves: CVE-2024-24770 Source advisory: OSV:PYSEC-2026-2005...

vantage6-node (3.3.4), vantage6-server (3.3.4) potentially affected by CVE-2024-24770 via vantage6 (3.3.4)

vantage6 PYPI version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.3.4 - vantage6-server 3.3.4 Source cves: CVE-2024-24770 Source advisory: OSV:PYSEC-2026-2005...

vantage6-node (3.5.2), vantage6-server (3.5.2) potentially affected by CVE-2024-24770 via vantage6 (3.5.2)

vantage6 PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.5.2 - vantage6-server 3.5.2 Source cves: CVE-2024-24770 Source advisory: OSV:PYSEC-2026-2005...

vantage6-node (3.8.8), vantage6-server (3.8.8) potentially affected by CVE-2024-24770 via vantage6 (3.8.8)

vantage6 PYPI version 3.8.8 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.8.8 - vantage6-server 3.8.8 Source cves: CVE-2024-24770 Source advisory: OSV:PYSEC-2026-2005...

vantage6-node (3.9.0rc4), vantage6-server (3.9.0rc4) potentially affected by CVE-2024-24770 via vantage6 (3.9.0rc4)

vantage6 PYPI version 3.9.0rc4 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.9.0rc4 - vantage6-server 3.9.0rc4 Source cves: CVE-2024-24770 Source advisory: OSV:PYSEC-2026-2005...

vantage6-node (3.3.0rc1), vantage6-server (3.3.0rc1) potentially affected by CVE-2024-24770 via vantage6 (3.3.0rc1)

vantage6 PYPI version 3.3.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.3.0rc1 - vantage6-server 3.3.0rc1 Source cves: CVE-2024-24770 Source advisory: OSV:GHSA-5H3X-6GWF-73JM...

vantage6-node (3.3.8a2), vantage6-server (3.3.8a2) potentially affected by CVE-2024-24770 via vantage6 (3.3.8a2)

vantage6 PYPI version 3.3.8a2 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.3.8a2 - vantage6-server 3.3.8a2 Source cves: CVE-2024-24770 Source advisory: OSV:GHSA-5H3X-6GWF-73JM...

vantage6-node (3.3.0), vantage6-server (3.3.0) potentially affected by CVE-2024-24770 via vantage6 (3.3.0)

vantage6 PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.3.0 - vantage6-server 3.3.0 Source cves: CVE-2024-24770 Source advisory: OSV:GHSA-5H3X-6GWF-73JM...

CVE-2024-24770

vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Much like GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes /recover/lost and /2fa/lost...

CVE-2024-24770 Username timing attack on recover password/MFA token in vantage6

vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Much like GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes /recover/lost and /2fa/lost...

CVE-2024-24770 Username timing attack on recover password/MFA token in vantage6

vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Much like GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes /recover/lost and /2fa/lost...

CVE-2024-24770

Vantage6 exposes two API endpoints, /recover/lost and /2fa/lost, which allow an attacker to enumerate existing usernames via recovery-email behavior or timing differences. Root cause: inadequate access controls on recovery utilities leading to user enumeration. Impact: potential targeted credenti...