CVE-2020-24876

CRITICAL 9.8CVE-2020-24876 · Published 03/09/2020 · updated 17/06/2026

In short

CVE-2020-24876 is a CRITICAL (CVSS 9.8) vulnerability affecting pancake (pancakeapp).
Chance of exploitation in the next 30 days (EPSS): 1.7%, higher than 77.8% of all vulnerabilities.
Fix: update to 4.13.29 or later.

Package	Affected versions	Patched versions
pancake pancakeapp	`< 4.13.29`	`4.13.29`

Description

Use of a hard-coded cryptographic key in Pancake versions < 4.13.29 allows an attacker to forge session cookies, which may lead to remote privilege escalation.

References

pancakeapp.com/blog/entry/pancake-4.13.29-released · Release Notes
vaadata.com/blog/hardcoded-secret-leads-to-account-takeover · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free