VULNERABILITY INTELLIGENCE
CVE-2024-12056
EPSS probability0.36%
CISA KEVNot currently listed
Published2024-12-04
Last modified2026-06-17
Description
The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment. Exploitation requires valid credentials and does not permit the attacker to bypass user privileges.
Weakness classification
- 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932: CWE-358