CVE-2024-50486CWE-288

WordPress Acnoo Flutter API plugin <= 1.0.5 - Account Takeover vulnerability

Critical · published October 28, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
44.3
In the wild
Unconfirmed
What it is

🚨 An authentication bypass is lurking in the Acnoo Flutter API! With versions up to 1.0.5, accessing secure areas is disturbingly easy for an attacker. 🔥 Think of it like a hotel with a secret side entrance that skips the front desk—anyone could just stroll in without checking in properly! This flaw allows unauthorized users to bypass authentication checks entirely, meaning they can gain access to sensitive user data or privileged areas of the application. The consequences could be absolutely devastating, exposing your application to a range of malicious activities.

Put simply

Think of it like a hotel with a secret side entrance that skips the front desk—anyone could just stroll in without checking in properly! The vulnerability exists due to improper routing that allows access through an alternate path or channel without the necessary authentication checks, making it a critical security risk.

What to do

This flaw allows unauthorized users to bypass authentication checks entirely, meaning they can gain access to sensitive user data or privileged areas of the application. The consequences could be absolutely devastating, exposing your application to a range of malicious activities. Update the Acnoo Flutter API to version 1.0.6 immediately to close this gap. Conduct a thorough review of your authentication controls to ensure that all access points are properly secured. Don't forget to alert your development team about this issue! You've got this! Fixing it now will keep your application secure and users safe. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00535 · 44.3th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2024-10-28T11:19Z
EPSS history
Timeline
  • 28 OCT 11:19Z
    WordPress Acnoo Flutter API plugin <= 1.0.5 - Account Takeover vulnerability
    cvelistv5