CVE-2024-34354

CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 are impacted. The issue is the user JWT Token is not verified on server session. You should take the patch 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 into your fork.

• CWE-345

• https://github.com/CriticalMoments/CMSaasStarter/commit/7904d416d2c72ec75f42fbf51e9e64fa74062ee6
• https://github.com/CriticalMoments/CMSaasStarter/pull/65
• https://github.com/CriticalMoments/CMSaasStarter/security/advisories/GHSA-qgcj-9rxf-rw7q
• https://github.com/CriticalMoments/CMSaasStarter/commit/7904d416d2c72ec75f42fbf51e9e64fa74062ee6
• https://github.com/CriticalMoments/CMSaasStarter/pull/65
• https://github.com/CriticalMoments/CMSaasStarter/security/advisories/GHSA-qgcj-9rxf-rw7q

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34349Sylius is an open source eCommerce platform. Prior to 1.12.1…4.8
• CVE-2024-3435A path traversal vulnerability exists in the 'save_settings'…8.4
• CVE-2024-34350Next.js is a React framework that can provide building block…7.5
• CVE-2024-34351Next.js is a React framework that can provide building block…7.5
• CVE-2024-343521Panel is an open source Linux server operation and maintena…7.5
• CVE-2024-34353The matrix-sdk-crypto crate, part of the Matrix Rust SDK pro…5.5
• CVE-2024-34355TYPO3 is an enterprise content management system. Starting i…5.4
• CVE-2024-34356TYPO3 is an enterprise content management system. Starting i…5.4
• CVE-2024-34357TYPO3 is an enterprise content management system. Starting i…5.4
• CVE-2024-34358TYPO3 is an enterprise content management system. Starting i…5.3
• CVE-2024-34359llama-cpp-python is the Python bindings for llama.cpp. `llam…9.6
• CVE-2024-3436A vulnerability was found in SourceCodester Prison Managemen…7.2