CVE-2023-49706

6.8 mediumEPSS 0.6%

Medium (6.8) in linotp. EPSS 0.6% chance of exploitation in the next 30 days.

Defective request context handling in Self Service in LinOTP 3.x before 3.2.5 allows remote unauthenticated attackers to escalate privileges, thereby allowing them to act as and with the permissions of another user. Attackers must generate repeated API requests to trigger a race condition with concurrent user activity in the self-service portal.

Severity

CVSS 3.1

6.8 medium

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-362
Published: 2023-12-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

linotp:linotp
linotp:virtual_appliance

References

https://linotp.org/CVE-2023-49706.txt
https://linotp.org/security-update-linotp3-selfservice.html
https://www.linotp.org/news.html
https://linotp.org/CVE-2023-49706.txt
https://linotp.org/security-update-linotp3-selfservice.html

Check your stack JSON