CVE-2024-36588: Authentication Bypass by Spoofing
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 09:15 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 32% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 13 Jun 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2024-36588, organizations should: 1) Immediately monitor and audit message logs for suspicious or anomalous message attributions to detect potential spoofing attempts. 2) Implement additional application-layer authentication and authorization checks to verify message origin and user identity before processing or displaying messages. 3) Employ network-level protections such as Web Application Firewalls (WAFs) to detect and block crafted HTTP requests that attempt to exploit this vulnerability. 4) Educate users about the risk of interacting with suspicious messages and encourage verification of message authenticity through out-of-band channels. 5) Engage with the software vendor or community to obtain patches or updates addressing this vulnerability as soon as they become available. 6) Consider deploying anomaly detection systems that can flag unusual messaging patterns indicative of spoofing. 7) Restrict access to the vulnerable application components to trusted networks or VPNs where feasible to reduce exposure. These steps go beyond generic advice by focusing on detection, user awareness, and layered defenses tailored to the specific nature of the vulnerability.
Description
An issue in Annonshop.app DecentralizeJustice/ anonymousLocker commit 2b2b4 allows attackers to send messages erroneously attributed to arbitrary users via a crafted HTTP request.