Apache HugeGraph-Server: Fixed JWT Token (Secret)

CRITICAL 9.8CVE-2024-43441 · GHSA-f697-gm3h-xrf9 · Published 24/12/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
org.apache.hugegraph:hugegraph-server Maven	`≥ 1.0.0, < 1.5.0`	`1.5.0`
hugegraph apache	`≥ 1.0.0, < 1.5.0`	`1.5.0`

Description

Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server.

This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0.

Users are recommended to upgrade to version 1.5.0, which fixes the issue.

NVD description

Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2024-43441 · ADVISORY
apache/incubator-hugegraph commit 03b40a5 · WEB
apache/incubator-hugegraph · PACKAGE
lists.apache.org/thread/h2607yv32wgcrywov960jpxhvsmmlf12 · WEB
openwall.com/lists/oss-security/2024/12/24/2 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free