CVE-2024-45394

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only AES-256 and the EVP_BytesToKey KDF. Therefore, attackers with a copy of a user's data are able to brute-force the user's encryption key. Users on version 8.0.0 and above are automatically migrated away from the weak encoding on first login. Users should destroy encrypted backups made with versions prior to 8.0.0.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-261 CWE-327 CWE-326

Affected software

No affected versions have been published.

Timeline

Published: Sep 3, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-453957.5sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 whe CVE-2024-453967.5Quicly is an IETF QUIC protocol implementation. Quicly up to commtit d720707 is susceptible to a denial-of-service attack. A remote attacker CVE-2024-453977.5h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or CVE-2024-453988.8Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute th CVE-2024-453996.1Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version CVE-2024-45407.5A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain CVE-2024-454006.1ckeditor-plugin-openlink is a plugin for the CKEditor JavaScript text editor that extends the context menu with a possibility to open a link CVE-2024-454017.1stripe-cli is a command-line tool for the payment processor Stripe. A vulnerability exists in stripe-cli starting in version 1.11.1 and prio CVE-2024-454029.8Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. When parsing a spoofed TLS han CVE-2024-454037.5h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancel CVE-2024-454048.1OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does n CVE-2024-454056.0`gix-path` is a crate of the `gitoxide` project (an implementation of `git` written in Rust) dealing paths and their conversions. Prior to v