CVE-2024-46937

The MFASOFT Secure Authentication Server (SAS) versions 1.8.x through 1.9.x (prior to 1.9.040924) contain an improper access control (IDOR) vulnerability in the /api-selfportal/get-info-token-properties endpoint. This flaw allows remote attackers to gain unauthorized access to user tokens without...