CVE-2024-3596

Advisory

BlastRADIUS impacts eduMFA due to unchecked Message-Authenticator attributes. An attacker can initiate an authentication flow using a RADIUS-backed token, intercept the RADIUS packet sent by eduMFA, and alter the response from the RADIUS server. This manipulation can deceive eduMFA into accepting the token as valid, even if the RADIUS server originally responded with a rejection.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/eduMFA/eduMFA/commit/ad9d18be31e8a6f536c646dc037d945de33fac60
• https://github.com/advisories/GHSA-3g8x-wqfp-q876
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3596