What’s Vulnerable › Vulnerabilities

CVE-2023-49706

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-12-19 · updated 2026-06-17
• Weakness: CWE-362

Description

Defective request context handling in Self Service in LinOTP 3.x before 3.2.5 allows remote unauthenticated attackers to escalate privileges, thereby allowing them to act as and with the permissions of another user. Attackers must generate repeated API requests to trigger a race condition with concurrent user activity in the self-service portal.

Affected products

• Linotp: from 3.0.0 through 3.2.4
• Linotp Virtual Appliance: from 3.0.0 through 3.2.4

References

• https://linotp.org/CVE-2023-49706.txt
• https://linotp.org/security-update-linotp3-selfservice.html
• https://www.linotp.org/news.html
• https://linotp.org/CVE-2023-49706.txt
• https://linotp.org/security-update-linotp3-selfservice.html
• https://www.linotp.org/news.html

Get alerted when CVE-2023-49706 or the next vulnerability affects your stack