CVE-2020-14423

MEDIUM 5.3CVE-2020-14423 · Published 18/06/2020 · updated 17/06/2026

In short

CVE-2020-14423 is a MEDIUM (CVSS 5.3) vulnerability affecting convos (convos).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 64.7% of all vulnerabilities.
Fix: update to 4.20 or later.

Package	Affected versions	Patched versions
convos convos	`< 4.20`	`4.20`

Description

Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOS_LOCAL_SECRET value, affecting password resets and invitations.

References

convos.chat/blog/2020/6/18/local-secret-got-more-secure · Vendor Advisory
Nordaaker/convos commit 54d1763 · Patch
Nordaaker/convos · Patch

More vulnerabilities in convos

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free