CVE-2024-45042

Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 1.3.0, given a number of preconditions, the `highest_available` setting will incorrectly assume that the identity’s highest available AAL is `aal1` even though it really is `aal2`. This means that the `highest_available` configuration will act as if the user has only one factor set up, for that particular user. This means that they can call the settings and whoami endpoint without a `aal2` session, even though that should be disallowed. An attacker would need to steal or guess a valid login OTP of a user who has only OTP for login enabled and who has an incorrect `available_aal` value stored, to exploit this vulnerability. All other aspects of the session (e.g. the session’s aal) are not impacted by this issue. On the Ory Network, only 0.00066% of registered users were affected by this issue, and most of those users appeared to be test users. Their respective AAL values have since been updated and they are no longer vulnerable to this attack. Version 1.3.0 is not affected by this issue. As a workaround, those who require MFA should disable the passwordless code login method. If that is not possible, check the sessions `aal` to identify if the user has `aal1` or `aal2`.

• CWE-287

• https://github.com/ory/kratos/security/advisories/GHSA-wc43-73w7-x2f5

Published

Sep 26, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45037The AWS Cloud Development Kit (CDK) is an open-source framew…6.4
• CVE-2024-45038Meshtastic device firmware is a firmware for meshtastic devi…7.5
• CVE-2024-45039gnark is a fast zk-SNARK library that offers a high-level AP…6.2
• CVE-2024-4504A vulnerability, which was classified as critical, has been …7.2
• CVE-2024-45040gnark is a fast zk-SNARK library that offers a high-level AP…5.9
• CVE-2024-45041External Secrets Operator is a Kubernetes operator that inte…8.8
• CVE-2024-45043The OpenTelemetry Collector module AWS firehose receiver is …5.3
• CVE-2024-45044Bareos is open source software for backup, archiving, and re…8.8
• CVE-2024-45045Collabora Online is a collaborative online office suite base…6.1
• CVE-2024-45046PHPSpreadsheet is a pure PHP library for reading and writing…5.4
• CVE-2024-45047svelte performance oriented web framework. A potential mXSS …6.1
• CVE-2024-45048PHPSpreadsheet is a pure PHP library for reading and writing…6.5