Insecure Randomness in Caddy Security Could Lead to OAuth Replay Attacks and MFA Secret Exposure

CVE-2024-21495

What is CVE-2024-21495?

The Caddy Security package by Greenpau before version 1.0.42 introduces vulnerabilities due to the use of an insecure random number generation library. Attackers could exploit predictable nonce values used in the OAuth authentication flow, making it possible to conduct OAuth replay attacks. Furthermore, the insecure randomness also affects the generation of multifactor authentication (MFA) secrets and API keys stored in the database, potentially compromising the security of users and their authentication processes.

References