What’s Vulnerable › Vulnerabilities

CVE-2024-1403: Authentication Bypass in OpenEdge Authentication Gateway and AdminServer

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-27 · updated 2026-06-17
• Weakness: CWE-305

Description

In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified.  The vulnerability is a bypass to authentication based on a failure to properly handle username and password. Certain unexpected content passed into the credentials can lead to unauthorized access without proper authentication.

Affected products

• Progress Software Corporation OpenEdge: before 11.7.19; from 11.8 before 12.2.14; from 12.3 before 12.8.1 — fixed in 11.7.19, 12.2.14, 12.8.1

How to fix

Upgrade to a fixed version: Progress Software Corporation OpenEdge 11.7.19, 12.2.14, 12.8.1. Check the vendor advisory for mitigations.

References

• https://community.progress.com/s/article/Important-Critical-Alert-for-OpenEdge-Authentication-Gateway-and-AdminServer
• https://www.progress.com/openedge
• https://community.progress.com/s/article/Important-Critical-Alert-for-OpenEdge-Authentication-Gateway-and-AdminServer
• https://www.progress.com/openedge

Get alerted when CVE-2024-1403 or the next vulnerability affects your stack