EUVD-2022-24956

Malicious code in bioql PyPI...

Authentication flaw

When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possible to bypass this restriction of validity to create extra user accounts above the initial number of invited users...

CVE-2022-1670

CVE-2022-1670 describes a vulnerability in Octopus Server where the validation on generated user invitation codes (the number of users the code remains valid for) can be bypassed, allowing creation of additional user accounts beyond the intended invited count. Affected: Octopus Server’s invitatio...