CVE-2024-45394
High
Description
Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only AES-256 and the EVP_BytesToKey KDF. Therefore, attackers with a copy of a user's data are able to brute-force the user's encryption key. Users on version 8.0.0 and above are automatically migrated away from the weak encoding on first login. Users should destroy encrypted backups made with versions prior to 8.0.0.
SeverityHigh
CVSS8.8
Exploit probability—
ProductAuthenticator
PublishedSep 3, 2024
First seenSep 3, 2024
Weakness typeCWE-261CWE-261CWE-327CWE-327
How to fix
Update
- authenticator authenticator8.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| authenticator authenticator | v < 8.0.0 | 8.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.