CVE-2024-27928 Vantage6: 2FA can be circumvented with hacked email access

vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, if an attacker hacks into a vantage6 user's email account, they can 1 reset the password via email and then 2 reset the 2FA token via email. This way they reduce 2FA to 1FA email access. Note that...

CVE-2024-27928

CVE-2024-27928 (Vantage6) describes a vulnerability in Vantage6 prior to 5.0.0 where an attacker with access to a user’s email can first reset the account password, then reset the 2FA token via email, effectively reducing 2FA to 1FA. This is tied to emails being used as a recovery vector and reli...

CVE-2024-24769 Vantage6: No limit on emails sent for password/MFA reset

vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, users can reset their MFA token via API routes that send them an email. Currently the number of emails that is sent is not limited. This gives attackers the option to flood someones mailbox with a l...

CVE-2024-24769 Vantage6: No limit on emails sent for password/MFA reset

vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, users can reset their MFA token via API routes that send them an email. Currently the number of emails that is sent is not limited. This gives attackers the option to flood someones mailbox with a l...

CVE-2024-24769

Vantage6 exposes a MFA reset flow via API that can email users without a limit to the number of emails sent (pre-5.0.0). Root cause: lack of rate limiting on MFA reset email dispatch. Impact is described as very low since MFA reset requires a valid password, but abuse can overwhelm a mailbox and ...

Access Control Bypass

Overview vantage6 is a vantage6 command line interface Affected versions of this package are vulnerable to Access Control Bypass due to improper restrictions in the node process. An attacker can access input and output files belonging to other algorithms by executing malicious code within algorit...

GHSA-X9F6-9RVM-MMRG vantage6 node has an Improper Access Control issue

Impact Malicious algorithms can potentially access other algorithms input and output files. Patches Todo Workarounds Verify and restrict the algorithm containers that are allowed to run on your node. See here on how to do this. References https://docs.vantage6.ai/usage/running-the-node/security F...

vantage6 node has an Improper Access Control issue

Impact Malicious algorithms can potentially access other algorithms input and output files. Patches Todo Workarounds Verify and restrict the algorithm containers that are allowed to run on your node. See here on how to do this. References https://docs.vantage6.ai/usage/running-the-node/security F...

Information Exposure

Overview vantage6 is a vantage6 command line interface Affected versions of this package are vulnerable to Information Exposure due to the use of default credentials for the initial administrative account. An attacker can gain unauthorized administrative access by logging in with the known defaul...

Use of Single-factor Authentication

Overview vantage6 is a vantage6 command line interface Affected versions of this package are vulnerable to Use of Single-factor Authentication through the password reset and 2FA token reset processes. An attacker can gain unauthorized access to user accounts by compromising the associated email...

GHSA-5549-C5Q7-FJ65 Vantage6: No limit on emails sent for password/MFA reset

Impact Users can reset their MFA token via API routes that send them an email. Currently the number of emails that is sent is not limited. This gives attackers the option to flood someones mailbox with a lot of emails, and would have adverse effects on the SMTP server which may be seen as spam...

Denial of Service (DoS)

Overview vantage6 is a vantage6 command line interface Affected versions of this package are vulnerable to Denial of Service DoS through the email reset process. An attacker can cause a user's mailbox to be flooded with emails and potentially impact the SMTP server by repeatedly triggering passwo...

PT-2026-50569

Name of the Vulnerable Software and Affected Versions vantage6 versions prior to 5.0.0 Description An open-source infrastructure for privacy preserving analysis provides an initial user with the username root and password root. This configuration is insecure as attackers are aware that most serve...

EUVD-2024-0829

Malicious code in bioql PyPI...

EUVD-2024-19784

Malicious code in bioql PyPI...

EUVD-2024-21974

Malicious code in bioql PyPI...

EUVD-2024-0168

Malicious code in bioql PyPI...

EUVD-2025-18201

Malicious code in bioql PyPI...

EUVD-2023-0256

Malicious code in bioql PyPI...

Brute Force Attack

vantage6 is vulnerable to Brute Force Attack. The vulnerability is due to insufficient rate limiting due to the ability to make unlimited password change attempts using an authenticated session, allowing attackers to guess passwords...