Threats tagged 'ghsa-9w6g-7jpw-87hf'

CTFd versions up to 3.7.4 contain a vulnerability where tokens used for account activation and password resetting are interchangeable and not single-use. These tokens are sent as GET parameters and include base64 encoded user emails. An attacker with network access during the token's validity period could reuse a token to change a user's password and take over the account. This issue was fixed in version 3.7.5.