CVE-2021-43786 CRITICAL

CVE-2021-43786: API token verification can be bypassed

Vendor Nodebb

Product NodeBB

Weakness CWE-287 · Improper authentication

Published November 29, 2021

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.

Key dates

02Disclosure timeline

November 29, 2021 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-43786 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/287.html

Related vulnerabilities

04Related CVE

CVE-2019-1867 Cisco Elastic Services Controller REST API Authentication Bypass Vulnerability CVE-2023-38096 NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability CVE-2023-51482 WordPress Eazy Plugin Manager plugin <= 4.1.2 - Auth. Arbitrary Options Update lead to RCE vulnerability CVE-2024-10173 didi DDMQ Console Module improper authentication CVE-2026-4349 Duende IdentityServer4 Token Renewal Endpoint authorize improper authentication