CVE-2024-12839
The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deployed on their device will send an authentication signature to the website. An unauthenticated remote attacker who obtains this signature can use it to log into the system with any device.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS probability
- 0.70%
- CWE
- CWE-294
- Published
- 2024-12-31
- Last modified
- 2026-03-13
Affected products
- Changing Information Technology CGFIDO
Weakness type
Related vulnerabilities
- CVE-2026-88278 — GV-LPCLPC2011/2211 - ONVIF WS-Security PasswordDigest Replay
- CVE-2026-55250 — Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches
- CVE-2026-84003 — Microsoft Authentication Library (MSAL) for Node.js Spoofing Vulnerability
- CVE-2026-69676 — Windows Kerberos Remote Code Execution Vulnerability
- CVE-2026-73312 — XenForo < 2.3.13 Refresh Token Replay via Expired Access Token
- CVE-2026-73311 — XenForo < 2.3.13 OAuth2 Authorization Code Reuse
- CVE-2022-51016 — PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replay
- CVE-2026-86219 — Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step