CVE-2024-31205

Saleor is an e-commerce platform. Starting in version 3.10.0 and prior to versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19, an attacker may bypass cross-set request forgery (CSRF) validation when calling refresh token mutation with empty string. When a user provides an empty string in `refreshToken` mutation, while the token persists in `JWT_REFRESH_TOKEN_COOKIE_NAME` cookie, application omits validation against CSRF token and returns valid access token. Versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19 contain a patch for the issue. As a workaround, one may replace `saleor.graphql.account.mutations.authentication.refresh_token.py.get_refresh_token`. This will fix the issue, but be aware, that it returns `JWT_MISSING_TOKEN` instead of `JWT_INVALID_TOKEN`.

• CWE-352

• https://github.com/saleor/saleor/commit/36699c6f5c99590d24f46e3d5c5b1a3c2fd072e7Patch
• https://github.com/saleor/saleor/security/advisories/GHSA-ff69-fwjf-3c9wMitigation, Patch, Vendor Advisory
• https://github.com/saleor/saleor/commit/36699c6f5c99590d24f46e3d5c5b1a3c2fd072e7Patch
• https://github.com/saleor/saleor/security/advisories/GHSA-ff69-fwjf-3c9wMitigation, Patch, Vendor Advisory

Published

Apr 8, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3120A stack-buffer overflow vulnerability exists in all versions…9.8
• CVE-2024-31200A “CWE-201: Insertion of Sensitive Information Into Sent Dat…4.6
• CVE-2024-31201A “CWE-428: Unquoted Search Path or Element” affects the The…6.7
• CVE-2024-31202A “CWE-732: Incorrect Permission Assignment for Critical Res…7.8
• CVE-2024-31203A “CWE-121: Stack-based Buffer Overflow” in the wd210std.dll…5.5
• CVE-2024-31204mailcow: dockerized is an open source groupware/email suite …6.1
• CVE-2024-31206dectalk-tts is a Node package to interact with the aeiou Dec…8.2
• CVE-2024-31207Vite (French word for "quick", pronounced /vit/, like "veet"…5.9
• CVE-2024-31208Synapse is an open-source Matrix homeserver. A remote Matrix…6.5
• CVE-2024-31209oidcc is the OpenID Connect client library for Erlang. Denia…5.3
• CVE-2024-3121A remote code execution vulnerability exists in the create_c…3.3
• CVE-2024-31210WordPress is an open publishing platform for the Web. It's p…8.8