CVE-2024-39314

toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass `--read-bearer-token-from-stdin` to the launch arguments and feed the token from the standard input in version 0.4.14 or later. Earlier versions do not have this workaround.

• CWE-200
• CWE-214

• https://github.com/KisaragiEffective/toy-blog/commit/4d003e46a944d8f44ea02c63f4beefa4cbe1f4f7
• https://github.com/KisaragiEffective/toy-blog/security/advisories/GHSA-q8g2-c3x5-gp89
• https://github.com/KisaragiEffective/toy-blog/commit/4d003e46a944d8f44ea02c63f4beefa4cbe1f4f7
• https://github.com/KisaragiEffective/toy-blog/security/advisories/GHSA-q8g2-c3x5-gp89

Published

Jul 1, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39309Parse Server is an open source backend that can be deployed …9.8
• CVE-2024-3931A vulnerability was found in Totara LMS up to 18.7. It has b…5.4
• CVE-2024-39310The Basil recipe theme for WordPress is vulnerable to Persis…5.4
• CVE-2024-39311Publify is a self hosted Web publishing platform on Rails. P…5.4
• CVE-2024-39312Botan is a C++ cryptography library. X.509 certificates can …5.3
• CVE-2024-39313toy-blog is a headless content management system implementat…5.3
• CVE-2024-39315Pomerium is an identity and context-aware access proxy. Prio…6.5
• CVE-2024-39316Rack is a modular Ruby web server interface. Starting in ver…6.5
• CVE-2024-39317Wagtail is an open source content management system built on…4.9
• CVE-2024-39318The Ibexa Admin UI Bundle contains all the necessary parts t…5.4
• CVE-2024-39319aimeos/ai-controller-frontend is the Aimeos frontend control…5.3
• CVE-2024-3932A vulnerability classified as problematic has been found in …3.1