{"id":"CVE-2024-24770","published":"2024-03-14T18:47:46Z","modified":"2024-08-26T15:21:53Z","title":"Username timing attack on recover password/MFA token in vantage6","vendor":"vantage6","product":"vantage6","tier":"tail","description":{"text":"vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Much like GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes `/recover/lost` and `/2fa/lost`. These routes send emails to users if they have lost their password or MFA token. This issue has been addressed in commit `aecfd6d0e` and is expected to ship in subsequent releases. Users are advised to upgrade as soon as a new release is available. There are no known workarounds for this vulnerability.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00397,"percentile":0.3395,"provenance":"source"},"cwes":[{"id":"CWE-362","name":"Concurrent Execution using Shared Resource with Improper Synchronization"},{"id":"CWE-208","name":"Observable Timing Discrepancy"}],"references":[{"url":"https://github.com/vantage6/vantage6/security/advisories/GHSA-5h3x-6gwf-73jm","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53","tags":["x_refsource_MISC"]},{"url":"https://github.com/vantage6/vantage6/commit/aecfd6d0e83165a41a60ebd52d2287b0217be26b","tags":["x_refsource_MISC"]}],"priority":{"score":10.5,"factors":[{"name":"EPSS percentile","points":6.79},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"vantage6","affectedVersions":[{"vendor":"vantage6","product":"vantage6","versions":["<= 4.2.2"]}],"affected":[{"ecosystem":"PyPI","package":"vantage6","vulnerableRanges":["<4.3.0"],"patched":["4.3.0"],"from":["GHSA-5h3x-6gwf-73jm","PYSEC-2026-2005"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0829","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-vantage6-cve-2024-21671","parents":[{"from":"CVE-2024-21671","to":"CVE-2024-24770","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-45gq-q4xh-cp53","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-5h3x-6gwf-73jm","via":"reference","url":"https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53"},{"kind":"osv-related","provenance":"source","id":"PYSEC-2026-2005","via":"reference","url":"https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53"}]}],"packageHistory":[{"cve":"CVE-2024-21671","published":"2024-01-30","fixed":"4.2.0","kev":false},{"cve":"CVE-2024-22193","published":"2024-01-30","fixed":"4.2.0","kev":false},{"cve":"CVE-2024-23823","published":"2024-03-14","fixed":"4.3.0","kev":false},{"cve":"CVE-2024-24770","published":"2024-03-14","fixed":"4.3.0","kev":false},{"cve":"CVE-2024-32969","published":"2024-05-23","fixed":"4.5.0rc3","kev":false,"link":{"from":"CVE-2024-24770","to":"CVE-2024-32969","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:vantage6","fromFixed":"4.3.0","toFixed":"4.5.0rc3","daysApart":70}]}},{"cve":"CVE-2025-43863","published":"2025-06-12","fixed":"4.11.0","kev":false},{"cve":"CVE-2024-24769","published":"2026-06-17","fixed":"5.0.0","kev":false}],"package":"PyPI:vantage6"}}