182 matches found
GHSA-WC43-73W7-X2F5 Ory Kratos's setting required_aal `highest_available` does not properly respect code + mfa credentials
Preconditions - The code login method is enabled with the passwordlessenabled flag set to true . - A 2FA method such as totp is enabled. - requiredaal of the whomai check or the settings flow is set to highestavailable. AAL stands for Authenticator Assurance Levels and can range from 0 no factor ...
Ory Kratos's setting required_aal `highest_available` does not properly respect code + mfa credentials
Preconditions - The code login method is enabled with the passwordlessenabled flag set to true . - A 2FA method such as totp is enabled. - requiredaal of the whomai check or the settings flow is set to highestavailable. AAL stands for Authenticator Assurance Levels and can range from 0 no factor ...
CVE-2024-45042 Ory Kratos's `highest_available` setting does not properly respect code + mfa credentials
Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 1.3.0, given a number of preconditions, the highestavailable setting will incorrectly assume that the identity’s highest available AAL is aal1 even though it really is aal2. This means that t...
CVE-2024-45042
Summary of CVE-2024-45042 (Ory Kratos) : Before version 1.3.0, under certain preconditions, the setting highest_available can misreport the identity’s highest AAL, reporting it as aal1 instead of the true aal2. This causes the system to behave as if the user has only one factor, allowing requests...
CVE-2024-45042 Ory Kratos's `highest_available` setting does not properly respect code + mfa credentials
Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 1.3.0, given a number of preconditions, the highestavailable setting will incorrectly assume that the identity’s highest available AAL is aal1 even though it really is aal2. This means that t...
CVE-2024-45042 Ory Kratos's `highest_available` setting does not properly respect code + mfa credentials
Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 1.3.0, given a number of preconditions, the highestavailable setting will incorrectly assume that the identity’s highest available AAL is aal1 even though it really is aal2. This means that t...
CVE-2024-45042
Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 1.3.0, given a number of preconditions, the "highestavailable" setting will incorrectly assume that the identity’s highest available AAL is "aal1" even though it really is "aal2". This means...
Ory Kratos 授权问题漏洞
Ory Kratos is a developer-friendly, secure, and proven cloud identity, user management, and authentication system from Ory Open Source. An authorization issue vulnerability exists in Ory Kratos versions prior to 1.3.0 that stems from the highestavailable setting incorrectly assuming that the...
PT-2024-31393 · Ory · Ory Kratos
Name of the Vulnerable Software and Affected Versions: Ory Kratos versions prior to 1.3.0 Description: Ory Kratos is an identity, user management, and authentication system for cloud services. The highest available setting incorrectly assumes the identity's highest available Authenticator Assuran...
CVE-2024-45042: Improper Authentication
Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 1.3.0, given a number of preconditions, the highestavailable setting will incorrectly assume that the identity’s highest available AAL is aal1 even though it really is aal2. This means that t...
GO-2022-0920 Incorrect Authorization in ORY Oathkeeper in github.com/ory/oathkeeper
Incorrect Authorization in ORY Oathkeeper in github.com/ory/oathkeeper...
GO-2022-0786 Authentication Bypass in hydra in github.com/ory/hydra
Authentication Bypass in hydra in github.com/ory/hydra...
GO-2022-0406 Possible bypass of token claim validation when OAuth2 Introspection caching is enabled in github.com/ory/oathkeeper
Possible bypass of token claim validation when OAuth2 Introspection caching is enabled in github.com/ory/oathkeeper...
Malicious code in ory-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 10ee2bc9e167728f46f301228a2569bcd7eda2f19c27f24784dd4497cf1af3be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in otnet-ory-network-tests (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19a9ebfed32ec491b007a6c7e65f8ebae68d0acc3175b56442fa67e25fc916fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8555 Malicious code in otnet-ory-network-tests (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19a9ebfed32ec491b007a6c7e65f8ebae68d0acc3175b56442fa67e25fc916fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in ory-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97e67d3893cb4ea477e80d85d47524af218e6579c6e04ed4037580b05b45060d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8550 Malicious code in ory-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97e67d3893cb4ea477e80d85d47524af218e6579c6e04ed4037580b05b45060d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-1017 Malicious code in ory-hydra-mock-oauth2-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65a839721d0fab0dc481a43bb9cf463966ebf8badc1ed1a9beebdc0724262a94 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...