What’s Vulnerable › Vulnerabilities

CVE-2024-21500

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-02-17 · updated 2026-06-17
• Weakness: CWE-307

Description

All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts via the two-factor authentication (2FA). Although the application blocks the user after several failed attempts to provide 2FA codes, attackers can bypass this blocking mechanism by automating the application’s full multistep 2FA process.

Affected products

• Authcrunch Caddy-Security: all versions

References

• https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
• https://github.com/greenpau/caddy-security/issues/271
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249864
• https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
• https://github.com/greenpau/caddy-security/issues/271
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249864

Get alerted when CVE-2024-21500 or the next vulnerability affects your stack