| Package | Affected versions | Patched versions |
|---|---|---|
| secure authentication server | ≥ 1.8.0, < 1.9.040924 | 1.9.040924 |
An improper access control (IDOR) vulnerability in the /api-selfportal/get-info-token-properties endpoint in MFASOFT Secure Authentication Server (SAS) 1.8.x through 1.9.x before 1.9.040924 allows remote attackers gain access to user tokens without authentication. The is a brute-force attack on the serial parameter by number identifier: GA00001, GA00002, GA00003, etc.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free