Email Flooding Vulnerability in Vantage6 Open Source Infrastructure

CVE-2024-24769

What is CVE-2024-24769?

The vulnerability in Vantage6 allows users to reset their MFA token via API routes that send confirmation emails. However, prior to version 5.0.0, there is no limit to the number of reset emails that can be sent, which could allow attackers to overwhelm a user's mailbox. This behavior can adversely affect SMTP servers, potentially causing them to be flagged as spam due to excessive email traffic. Although resetting the MFA token requires the correct user password, the risk of mail flooding remains a concern for both users and service providers.

References