vantage6 refresh tokens do not expire

HIGH 8.8CVE-2023-23929 · GHSA-4w59-c3gc-rrhp · PYSEC-2023-54 · Published 04/03/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
vantage6 PyPI	`< 3.8.0`	`3.8.0`
vantage6 vantage6	`< 3.8.0`	`3.8.0`

Description

From issue:

Problem description Currently, the refresh token is valid indefinitely. This is bad security practice.

Desired solution The refresh token should get a validity of 24-48 hours.

Additional context

When implementing this, also check that the refresh token returns a new refresh token When implementing this, also adapt the UI so that it logs out if refresh token is no longer valid. When implementing this, ensure that nodes refresh their token periodically so that they do not have to be restarted manually.

Impact

Patches

None available

Workarounds

None available

NVD description

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.

References

vantage6/vantage6 security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2023-23929 · ADVISORY
vantage6/vantage6 commit 48ebfca · WEB
pypa/advisory-database · WEB
vantage6/vantage6 · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free