What’s Vulnerable › Vulnerabilities

CVE-2024-10318: NGINX OpenID Connect Vulnerability

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-06 · updated 2026-06-17
• Weakness: CWE-384

Description

A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim, they can force the session to associate it with the attacker-controlled account, leading to potential misuse of the victim's session.

Affected products

• F5 NGINX API Connectivity Manager: from 1.3.0 before 1.9.3 — fixed in 1.9.3
• F5 NGINX Ingress Controller: through 1.12.5; from 2.2.1 through 2.4.2; from 3.0.0 before 3.7.1 — fixed in 3.7.1
• F5 NGINX Instance Manager: from 2.5.0 before 2.17.4 — fixed in 2.17.4
• F5 Nginx Openid Connect: before 2024-10-24 — fixed in 2024-10-24

How to fix

Upgrade to a fixed version: F5 NGINX API Connectivity Manager 1.9.3; F5 NGINX Ingress Controller 3.7.1; F5 NGINX Instance Manager 2.17.4; F5 Nginx Openid Connect 2024-10-24. Check the vendor advisory for mitigations.

References

• https://my.f5.com/manage/s/article/K000148232

Get alerted when CVE-2024-10318 or the next vulnerability affects your stack