CVE-2024-11717

creationtimestamp| type| source ---|---|--- 2025-01-02 17:15:24+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lerlbatny62l 2025-01-02 17:42:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lermr2rirz2q 2025-01-02 19:16:50+00:00| seen|...

CVE-2024-11717

Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter and they are not single use, which means, that during token expiration time an on-path attacker might reuse such a token to...

CVE-2024-11717

CTFd (CTFd project) is affected by CVE-2024-11717. Tokens used for account activation and password resets are interchangeable and are transmitted as GET parameters; tokens are not single-use and can be reused within the expiration window, enabling an on-path attacker to reset a password and take ...