CVE-2024-34354
MEDIUMCMSaaSStarter <7904d416d2c72ec75f42fbf51e9e64fa74062ee6 - Auth Bypass
Title source: llmDescription
CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 are impacted. The issue is the user JWT Token is not verified on server session. You should take the patch 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 into your fork.
References (3)
Scores
CVSS v3
6.5
EPSS
0.0019
EPSS Percentile
40.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-345
Status
published
Products (1)
CriticalMoments/CMSaasStarter
< 7904d416d2c72ec75f42fbf51e9e64fa74062ee6
Published
May 14, 2024
Tracked Since
Feb 18, 2026