CVE-2022-24781: Malicious users can take over the session of other players

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-24 · updated 2026-06-17
Weakness: CWE-384

Description

Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through the browser console and become co-owners of the target session. This issue is patched in version 1.1.0. No known workaround exists.

Affected products

math-geon Geon: 1.0.0

References

https://github.com/math-geon/Geon/commit/005456d752d5434b60026edbc83b2665b8557d19
https://github.com/math-geon/Geon/releases/tag/v1.1.0
https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g2jh-j5xm
https://github.com/math-geon/Geon/commit/005456d752d5434b60026edbc83b2665b8557d19
https://github.com/math-geon/Geon/releases/tag/v1.1.0
https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g2jh-j5xm

Get alerted when CVE-2022-24781 or the next vulnerability affects your stack