cve.bz

CVE-2023-26494

6.1 mediumEPSS 0.6%

Medium (6.1) in thethingsnetwork lorawan-stack. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in go.thethings.network/lorawan-stack/v3 3.24.1.

lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may allows malicious actors to phish users, as users assume they were redirected to the homepage on login. Version 3.24.1 contains a fix.

Severity

CVSS 3.1

6.1 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE
CWE-601
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-5fwq-9x7j-2qpgGogo.thethings.network/lorawan-stack/v3<3.24.13.24.1
GO-2024-3044Gogo.thethings.network/lorawan-stackall versionsno fix published
GO-2024-3044Gogo.thethings.network/lorawan-stack/v3<3.24.13.24.1

References

Check your stackJSON