CVE-2024-55470: oqtane.framework · n/a
Affects oqtane.frameworkSource CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 39% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 20 Dec 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHuboqtane/oqtane.frameworkpkg:github/oqtane/oqtane.frameworkOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
To mitigate CVE-2024-55470, organizations should implement strict server-side validation of all authentication parameters, including the entityid, ensuring that client-supplied data cannot be trusted for access control decisions. Immediate steps include reviewing and updating the authentication logic to enforce server-side passcode validation and session management. If an official patch or update from the Oqtane Framework maintainers becomes available, it should be applied promptly. In the absence of a patch, organizations can implement web application firewall (WAF) rules to detect and block suspicious manipulation of the entityid parameter. Conduct thorough code reviews and penetration testing focusing on authentication and access control mechanisms. Additionally, monitoring application logs for unusual access patterns or repeated failed authentication attempts can help detect exploitation attempts. Educate developers on secure coding practices to avoid reliance on client-side validation for security-critical functions. Finally, consider isolating or restricting access to vulnerable applications until a fix is applied to reduce exposure.
Description
Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication.