CVE-2024-51479 is an authorization bypass vulnerability found in the Next.js framework component used by the Red Hat Trusted Artifact Signer Operator. The flaw arises from improper sanitization of a query parameter, leading to invalid routing conditions that can bypass path-based middleware authorization checks. This affects self-hosted applications lacking i18n configuration, specifically for pages directly under the root directory. The vulnerability is tracked under CWE-285 (Improper Authorization) and CWE-770. Red Hat's advisory indicates no current fix is available and that mitigation options are either unavailable or unsuitable for widespread deployment. The affected Red Hat Trusted Artifact Signer versions correspond to usage with OpenShift Container Platform 4.14 to 4.18. The vulnerability does not impact applications hosted on Vercel, and no known exploits are reported in the wild.

An attacker exploiting this vulnerability could bypass authorization controls in affected self-hosted applications, potentially gaining unauthorized access to sensitive data or functionality protected by path-based middleware authorization. The impact is limited to applications missing i18n configuration and only affects certain URL paths. There is no indication of integrity or availability impact beyond the authorization bypass. No known active exploitation has been reported.

Currently, no official fix or patch is available from Red Hat for this vulnerability. Red Hat states that available mitigation options do not meet their criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for updates. Applications hosted on Vercel are not vulnerable. Organizations should review their use of path-based middleware authorization and consider configuration changes or alternative authorization mechanisms to reduce exposure until a fix is released.