CVE-2024-34065

Summary: CVE-2024-34065 affects Strapi’s @strapi/plugin-users-permissions. By abusing two chained issues (Open Redirect and session token in a URL) prior to 4.24.2, an unauthenticated attacker can bypass authentication and obtain a third‑party token. The attack relies on dynamic OAuth callback co...

Strapi Security Vulnerabilities

Strapi is an open source content management system CMS. A security vulnerability exists in Strapi versions prior to 4.24.2, which stems from a vulnerability that allows an unauthenticated attacker to bypass the authentication mechanism and retrieve a third-party token...