CVE-2024-5322 CRITICAL

CVE-2024-5322: N-central Authentication Bypass via Session Rebinding

Vendor N-Able

Product N-central

Weakness CWE-288

Published July 1, 2024

Last update August 1, 2024

View on NVD All CVEs

CVSS base score

9.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass. This vulnerability is present in all Entra-supported deployments of N-central prior to 2024.3.

Key dates

02Disclosure timeline

July 1, 2024 CVE published

August 1, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-5322 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/288.html

Related vulnerabilities

04Related CVE

CVE-2025-47941 TYPO3 Has Broken Authentication in Backend MFA CVE-2024-6328 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass CVE-2026-25002 WordPress LearnPress – Sepay Payment plugin <= 4.0.0 - Broken Authentication vulnerability CVE-2026-7458 User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint CVE-2025-5821 Case Theme User <= 1.0.3 - Authentication Bypass via Social Login