CVE-2024-26331: ReCrystallize Server · Improper Authentication
Source CVE Database V5
Not known to be exploited · public detection template (Nuclei) · 51% EPSS · CVSS 7.5 High.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 51.2% chance of exploitation in 30 days – higher than 98% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 30 Apr 2024
Detectable: evidence found.
nuclei template: ReCrystallize Server - Authentication Bypass
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2024-26331, organizations should immediately implement the following measures: 1) Upgrade ReCrystallize Server to a patched version once available from the vendor; 2) Until a patch is released, deploy web application firewalls (WAFs) with rules to detect and block anomalous cookie modifications or unauthorized access patterns; 3) Implement server-side session management that binds authentication cookies to unique session identifiers and validates them on each request; 4) Enforce secure cookie attributes such as HttpOnly, Secure, and SameSite to reduce client-side manipulation risks; 5) Conduct thorough code reviews and penetration testing focused on authentication mechanisms to identify similar weaknesses; 6) Monitor logs for suspicious authentication bypass attempts and anomalous user behavior; 7) Educate developers and administrators on secure authentication design principles to prevent recurrence; 8) Restrict network access to the ReCrystallize Server to trusted IP ranges where feasible; 9) Employ multi-factor authentication (MFA) to add an additional layer of security beyond cookie-based authentication.
Description
ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to a session ID. Attackers can easily modify the cookie value, within a browser or by implementing client-side code outside of a browser. Attackers can bypass the authentication mechanism by modifying the cookie to contain an expected value.