Authentication Bypass Vulnerability in Apache Pinot

CVE-2024-56325

Summary

An authentication bypass vulnerability exists in Apache Pinot that allows malicious actors to add new users without authentication. This occurs when requests are sent to specific endpoints that do not enforce the required authentication checks. As a result, an attacker can submit a specially crafted POST request to gain unauthorized access, thereby enabling the control of Pinot. This significant flaw underscores the need for proper validation mechanisms and access controls within the application to prevent unauthorized user creation and privilege escalation.

References