CVE-2024-24554: Bludit - Insecure Token Generation

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-24 · updated 2026-06-17
Weakness: CWE-287

Description

Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allows attackers to authenticate against the Bludit API.

Affected products

Bludit: from 3.14.0 through 3.15.0

References

https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/
https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/

Get alerted when CVE-2024-24554 or the next vulnerability affects your stack