Read the docs
TI-2024-15832 Aliases CVE-2024-23838GHSA-67m4-qxp3-j6hh

TrueLayer.Client SSRF when fetching payment or payment provider

Priority MEDIUM 40CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet could be made which could lead to information disclosure. The issue can be mitigated by having strict egress rules limiting the destinations to which requests can be made, and applying strict validation to any user input passed to the `truelayer-dotnet` library. Versions of TrueLayer.Client `v1.6.0` and later are not affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00532 45th percentileScored 2026-11-07
Fix Fixed truelayer-dotnet (TrueLayer): 1.6.0TrueLayer.Client (NuGet): 1.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TrueLayertruelayer-dotnetbefore 1.6.01.6.0Patch availableCNA
—TrueLayer.Client (NuGet)before 1.6.01.6.0Patch availableGHSA-67m4-qxp3-j6hh
  • truelayer-dotnet VendorTrueLayer Affected before 1.6.0 Fixed in 1.6.0 Patch available CNA
  • TrueLayer.Client (NuGet) Vendor— Affected before 1.6.0 Fixed in 1.6.0 Patch available GHSA-67m4-qxp3-j6hh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:truelayer:truelayer.net:*:*:*:*:*:*:*:*before 1.6.0VulnerableTrueLayer
  • cpe:2.3:a:truelayer:truelayer.net:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·TrueLayer

Remediation

  • Fix · CNA truelayer-dotnet (TrueLayer) Fixed in 1.6.0
  • Fix · GHSA-67m4-qxp3-j6hh TrueLayer.Client (NuGet) Fixed in 1.6.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-23838
  2. 2026-10-03 Alias added: GHSA-67m4-qxp3-j6hh

References

Patch 1

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences