Email Account Compromise Vulnerability in Vantage6 by Vantage6

CVE-2024-27928

What is CVE-2024-27928?

The Vantage6 open-source infrastructure for privacy-preserving analysis has a vulnerability that can be exploited if an attacker gains access to a user's email account. They can reset the user's password and subsequently bypass the two-factor authentication (2FA), effectively converting it to a one-factor authentication system using just email access. While many email providers enforce 2FA for email access, making this scenario less likely, the vulnerability presents a serious risk to user accounts prior to the release of version 5.0.0, which contains the necessary patch. No known workarounds are available for this issue.

References