Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2024-21495 Details

Description

Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted via a brute-force search. Attackers could use the potentially predictable nonce value used for authentication purposes in the OAuth flow to conduct OAuth replay attacks. In addition, insecure randomness is used while generating multifactor authentication (MFA) secrets and creating API keys in the database package.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: [email protected]CVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/	CVE	Third Party Advisory
https://github.com/greenpau/caddy-security/issues/265	CVE	Issue Tracking
https://github.com/greenpau/go-authcrunch/commit/ecd3725baf2683eb1519bb3c81ae41085fbf7dc2	CVE	Patch
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6248275	CVE	Third Party Advisory
https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/	[email protected]	Third Party Advisory
https://github.com/greenpau/caddy-security/issues/265	[email protected]	Issue Tracking
https://github.com/greenpau/go-authcrunch/commit/ecd3725baf2683eb1519bb3c81ae41085fbf7dc2	[email protected]	Patch
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6248275	[email protected]	Third Party Advisory

see all 8 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-330	Use of Insufficiently Random Values	[email protected]
CWE-330	Use of Insufficiently Random Values	[email protected]

Affected Products

Product	Versions
greenpau caddy-security	< 1.0.42
CPE cpe:2.3:a:greenpau:caddy-security:::::::: Remediation No remediation found in references.

Change History

6 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Feb 26, 2025	Initial Analysis	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Feb 17, 2024	New CVE Received	[email protected]