CVEvulnerability

CVE-2024-12839

8.8 HIGH Published 2024-12-31 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2024-12-31
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-294

Description

The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deployed on their device will send an authentication signature to the website. An unauthenticated remote attacker who obtains this signature can use it to log into the system with any device.

Related

Weakness · CWE (1)

  • CWE-294 Authentication Bypass by Capture-replay weakness

References