Read the docs
TI-2024-14252 Aliases CVE-2024-21495GHSA-c7vf-m394-m4x4

Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable…

Priority HIGH 81CWE-330Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted via a brute-force search. Attackers could use the potentially predictable nonce value used for authentication purposes in the OAuth flow to conduct OAuth replay attacks. In addition, insecure randomness is used while generating multifactor authentication (MFA) secrets and creating API keys in the database package.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0068 52nd percentileScored 2026-11-07
Fix Fixed github.com/greenpau/caddy-security: 1.0.42

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—github.com/greenpau/caddy-securitybefore 1.0.421.0.42Patch availableCNA
—github.com/greenpau/caddy-security (Go)up to 1.0.42—No fix listedGHSA-c7vf-m394-m4x4
  • github.com/greenpau/caddy-security Vendor— Affected before 1.0.42 Fixed in 1.0.42 Patch available CNA
  • github.com/greenpau/caddy-security (Go) Vendor— Affected up to 1.0.42 Fixed in — No fix listed GHSA-c7vf-m394-m4x4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:greenpau:caddy-security:*:*:*:*:*:*:*:*before 1.0.42VulnerableGreenpau
  • cpe:2.3:a:greenpau:caddy-security:*:*:*:*:*:*:*:* Versions before 1.0.42 Vulnerable ·Greenpau

Remediation

  • Fix · CNA github.com/greenpau/caddy-security Fixed in 1.0.42

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-21495
  2. 2026-10-03 Alias added: GHSA-c7vf-m394-m4x4

References

Patch 1

Advisory 2

Other 2

  • TI-2024-14251 Authentication bypass by spoofing in github.com/greenpau/caddy-security CVSS 3.1MEDIUM 5.4
  • TI-2024-14254 Open redirect in github.com/greenpau/caddy-security CVSS 3.1MEDIUM 6.1
  • TI-2024-14250 Improper array index validation in github.com/greenpau/caddy-security CVSS 3.1MEDIUM 5.3
  • TI-2024-14256 Improper output encoding in github.com/greenpau/caddy-security CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences