CVE-2024-45394
Last modified
CVE-2024-45394 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only AES-256 and the EVP_BytesToKey KDF. EPSS estimates a 0.09% chance of exploitation in the next 30 days.
Description
Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only AES-256 and the EVP_BytesToKey KDF. Therefore, attackers with a copy of a user's data are able to brute-force the user's encryption key. Users on version 8.0.0 and above are automatically migrated away from the weak encoding on first login. Users should destroy encrypted backups made with versions prior to 8.0.0.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Authenticator | Authenticator | < 8.0.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-45394?
How severe is CVE-2024-45394?
How do I fix CVE-2024-45394?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-45389Pagefind, a fully static search library, initializes its dyn…5.4
- CVE-2024-4539An issue has been discovered in GitLab CE/EE affecting all v…6.5
- CVE-2024-45390@blakeembrey/template is a string template library. Prior to…9.8
- CVE-2024-45391Tina is an open-source content management system (CMS). Site…7.5
- CVE-2024-45392SuiteCRM is an open-source customer relationship management …4.3
- CVE-2024-45393Computer Vision Annotation Tool (CVAT) is an interactive vid…6.4
- CVE-2024-45395sigstore-go, a Go library for Sigstore signing and verificat…7.5
- CVE-2024-45396Quicly is an IETF QUIC protocol implementation. Quicly up to…7.5
- CVE-2024-45397h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …7.5
- CVE-2024-45398Contao is an Open Source CMS. In affected versions a back en…8.8
- CVE-2024-45399Indico is an event management system that uses Flask-Multipa…6.1
- CVE-2024-4540A flaw was found in Keycloak in OAuth 2.0 Pushed Authorizati…7.5
Are you affected by CVE-2024-45394?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST