PT-2024-32288

Name of the Vulnerable Software and Affected Versions MFASOFT Secure Authentication Server SAS versions 1.8.x through 1.9.x before 1.9.040924 Description An improper access control vulnerability in the "/api-selfportal/get-info-token-properties" endpoint allows remote attackers to gain access to...

CVE-2024-46937

An improper access control IDOR vulnerability in the /api-selfportal/get-info-token-properties endpoint in MFASOFT Secure Authentication Server SAS 1.8.x through 1.9.x before 1.9.040924 allows remote attackers gain access to user tokens without authentication. The is a brute-force attack on the...

CVE-2024-46937: Authorization Bypass Through User-Controlled Key

An improper access control IDOR vulnerability in the /api-selfportal/get-info-token-properties endpoint in MFASOFT Secure Authentication Server SAS 1.8.x through 1.9.x before 1.9.040924 allows remote attackers gain access to user tokens without authentication. The is a brute-force attack on the...