CVE-2024-21495

Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted via a brute-force search. Attackers could use the potentially predictable nonce value used for authentication purposes in the OAuth flow to conduct OAuth replay attacks. In addition, insecure randomness is used while generating multifactor authentication (MFA) secrets and creating API keys in the database package.

• CWE-330
• CWE-330

• https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/Third Party Advisory
• https://github.com/greenpau/caddy-security/issues/265Issue Tracking
• https://github.com/greenpau/go-authcrunch/commit/ecd3725baf2683eb1519bb3c81ae41085fbf7dc2Patch
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6248275Third Party Advisory
• https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/Third Party Advisory
• https://github.com/greenpau/caddy-security/issues/265Issue Tracking
• https://github.com/greenpau/go-authcrunch/commit/ecd3725baf2683eb1519bb3c81ae41085fbf7dc2Patch
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6248275Third Party Advisory

Published

Feb 17, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2149A vulnerability classified as critical was found in CodeAstr…7.2
• CVE-2024-21490This affects versions of the package angular from 1.3.0; ver…7.5
• CVE-2024-21491Versions of the package svix before 1.17.0 are vulnerable to…6.5
• CVE-2024-21492All versions of the package github.com/greenpau/caddy-securi…8.1
• CVE-2024-21493All versions of the package github.com/greenpau/caddy-securi…5.3
• CVE-2024-21494All versions of the package github.com/greenpau/caddy-securi…5.4
• CVE-2024-21496All versions of the package github.com/greenpau/caddy-securi…6.1
• CVE-2024-21497Versions of the package github.com/greenpau/caddy-security …6.1
• CVE-2024-21498All versions of the package github.com/greenpau/caddy-securi…5.3
• CVE-2024-21499All versions of the package github.com/greenpau/caddy-securi…4.3
• CVE-2024-2150A vulnerability, which was classified as critical, has been …5.3
• CVE-2024-21500All versions of the package github.com/greenpau/caddy-securi…6.5