Origin Validation Error in Conduit
Priority LOW 38CWE-346Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-346.
Summary
Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user from any server in most EDUs
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00168 6th percentileScored 2026-11-07
Fix Fixed Conduit (The Conduit Contributors): 0.8.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The Conduit Contributors | Conduit | before 0.8.0 | 0.8.0 | Patch available | CNA |
- Conduit VendorThe Conduit Contributors Affected before 0.8.0 Fixed in 0.8.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:conduit:conduit:*:*:*:*:*:*:*:* | before 0.8.0 | Vulnerable | The Conduit Contributors |
- cpe:2.3:a:conduit:conduit:*:*:*:*:*:*:*:* Versions before 0.8.0 Vulnerable ·The Conduit Contributors
Remediation
- Fix · CNA Conduit (The Conduit Contributors) Fixed in 0.8.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
The Conduit Contributors Conduit 0.8.0
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2024-05850 Missing Authorization in ConduitPriority MEDIUM 43
- TI-2024-05847 Incomplete Cleanup in ConduitPriority LOW 24
- TI-2024-05846 Use of a Key Past its Expiration Date in ConduitPriority LOW 21
Timeline
- 2026-10-02 Threatist record created from CVE-2024-6301
- 2026-10-03 Alias added: GHSA-j288-6xgr-g898
References
More The Conduit Contributors Conduit vulnerabilities
- TI-2024-05850 Missing Authorization in Conduit CVSS 3.1CRITICAL 9.9
- TI-2024-05849 Improper Handling of Insufficient Permissions or Privileges in Conduit CVSS 3.1HIGH 8.1
- TI-2024-05847 Incomplete Cleanup in Conduit CVSS 3.1MEDIUM 5.3
- TI-2024-05846 Use of a Key Past its Expiration Date in Conduit CVSS 3.1MEDIUM 4.8
Sources
- CVE-2024-6301 · CVE Program
- CVE-2024-6301 · NVD
- FIRST EPSS
- GHSA-j288-6xgr-g898 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences