Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-xceh-jx5u-7bbh
Vulnerability ID VCID-xceh-jx5u-7bbh
Aliases CVE-2024-34065
GHSA-wrvh-rcmr-9qfc
Summary @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in Strapi framework is its possible of an unauthenticated attacker to bypass authentication mechanisms and retrieve the 3rd party tokens. The attack requires user interaction (one click).
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-294 Authentication Bypass by Capture-replay
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00796 https://api.first.org/data/v1/epss?cve=CVE-2024-34065
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-wrvh-rcmr-9qfc
cvssv3.1 7.1 https://github.com/strapi/strapi
generic_textual HIGH https://github.com/strapi/strapi
cvssv3.1 7.1 https://github.com/strapi/strapi/commit/9c79921d22142a5de77ea26151550a14e4b12669
generic_textual HIGH https://github.com/strapi/strapi/commit/9c79921d22142a5de77ea26151550a14e4b12669
cvssv3.1 7.1 https://github.com/strapi/strapi/security/advisories/GHSA-wrvh-rcmr-9qfc
cvssv3.1_qr HIGH https://github.com/strapi/strapi/security/advisories/GHSA-wrvh-rcmr-9qfc
generic_textual HIGH https://github.com/strapi/strapi/security/advisories/GHSA-wrvh-rcmr-9qfc
ssvc Track https://github.com/strapi/strapi/security/advisories/GHSA-wrvh-rcmr-9qfc
cvssv3.1 7.1 https://nvd.nist.gov/vuln/detail/CVE-2024-34065
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-34065
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-34065
https://github.com/strapi/strapi
https://github.com/strapi/strapi/commit/9c79921d22142a5de77ea26151550a14e4b12669
CVE-2024-34065 https://nvd.nist.gov/vuln/detail/CVE-2024-34065
GHSA-wrvh-rcmr-9qfc https://github.com/advisories/GHSA-wrvh-rcmr-9qfc
GHSA-wrvh-rcmr-9qfc https://github.com/strapi/strapi/security/advisories/GHSA-wrvh-rcmr-9qfc
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://github.com/strapi/strapi
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://github.com/strapi/strapi/commit/9c79921d22142a5de77ea26151550a14e4b12669
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://github.com/strapi/strapi/security/advisories/GHSA-wrvh-rcmr-9qfc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-12T16:08:21Z/ Found at https://github.com/strapi/strapi/security/advisories/GHSA-wrvh-rcmr-9qfc
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-34065
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.74374
EPSS Score 0.00796
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:21:57.085485+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/@strapi/plugin-users-permissions/CVE-2024-34065.yml 38.6.0