CVE-2024-24771: open forms Access Control Flaw — Fix

Description

Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication weakness. Superusers who have their credentials (username + password) compromised could potentially have the second-factor authentication bypassed if an attacker somehow managed to authenticate to Open Forms. The maintainers of Open Forms do not believe it is or has been possible to perform this login. However, if this were possible, the victim's account may be abused to view (potentially sensitive) submission data or have been used to impersonate other staff accounts to view and/or modify data. Three mitigating factors to help prevent exploitation include: the usual login page (at `/admin/login/`) does not fully log in the user until the second factor was succesfully provided; the additional non-MFA protected login page at `/api/v2/api-authlogin/` was misconfigured and could not be used to log in; and there are no additional ways to log in. This also requires credentials of a superuser to be compromised to be exploitable. Versions 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain the following patches to address these weaknesses: Move and only enable the API auth endpoints (`/api/v2/api-auth/login/`) with `settings.DEBUG = True`. `settings.DEBUG = True` is insecure and should never be applied in production settings. Additionally, apply a custom permission check to the hijack flow to only allow second-factor-verified superusers to perform user hijacking.

Is your site exposed to CVE-2024-24771?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.7

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

Weakness Type (CWE)

CWE-284 CWE-284

CWE-287 Improper Authentication

CWE-654 CWE-654

Affected Products

Vendor	Product	Versions
maykinmedia	open_forms	< 2.2.9
maykinmedia	open_forms	2.3.0 — 2.3.7
maykinmedia	open_forms	2.4.0 — 2.4.5
maykinmedia	open_forms	2.5.0 — 2.5.2

References

Advisories & Patches

https://github.com/open-formulieren/open-forms/security/advisories/GHSA-64r3-x3gf-vp63 https://github.com/open-formulieren/open-forms/security/advisories/GHSA-64r3-x3gf-vp63

Other References

https://github.com/open-formulieren/open-forms/releases/tag/2.2.9 https://github.com/open-formulieren/open-forms/releases/tag/2.3.7 https://github.com/open-formulieren/open-forms/releases/tag/2.4.5 https://github.com/open-formulieren/open-forms/releases/tag/2.5.2 https://github.com/open-formulieren/open-forms/releases/tag/2.2.9 https://github.com/open-formulieren/open-forms/releases/tag/2.3.7 https://github.com/open-formulieren/open-forms/releases/tag/2.4.5 https://github.com/open-formulieren/open-forms/releases/tag/2.5.2

Frequently Asked Questions

What is CVE-2024-24771? +

Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication weakness. Superusers who have their credentials (username + password) compromised could potentially have the second-factor authentication bypassed if an attacker somehow managed to authenticate to Open Forms. The maintainers of Open Forms do not believe it is or has been possible to perform this login. However, if this were possible, the victim's account may be abused to view (potentially sensitive) submission data or have been used to impersonate other staff accounts to view and/or modify data. Three mitigating factors to help prevent exploitation include: the usual login page (at `/admin/login/`) does not fully log in the user until the second factor was succesfully provided; the additional non-MFA protected login page at `/api/v2/api-authlogin/` was misconfigured and could not be used to log in; and there are no additional ways to log in. This also requires credentials of a superuser to be compromised to be exploitable. Versions 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain the following patches to address these weaknesses: Move and only enable the API auth endpoints (`/api/v2/api-auth/login/`) with `settings.DEBUG = True`. `settings.DEBUG = True` is insecure and should never be applied in production settings. Additionally, apply a custom permission check to the hijack flow to only allow second-factor-verified superusers to perform user hijacking. It has a CVSS v3.1 base score of 7.7 (HIGH).

How severe is CVE-2024-24771? +

CVE-2024-24771 has a CVSS v3.1 score of 7.7 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-24771? +

CVE-2024-24771 affects products from maykinmedia, specifically: open_forms. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-24771? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-35402

mcp-neo4j-cypher is an MCP server for executing Cypher queries against Neo4j databases. In versions prior to 0.6.0, the read_only mode …

CVE-2026-40866

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in …

CVE-2026-40865

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in …

CVE-2026-40874

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes …

CVE-2026-54533

vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, malicious algorithms can potentially access other algorithms …

CVE-2026-48907

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately …

CVE-2024-24771