CVE-2020-27199 Auth bypass in n/a
Attackers can bypass authentication in the Magic Home Pro Android app by forging user tokens, gaining unauthorized access to victim accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-27199?
CVE-2020-27199 is a high-severity authentication bypass vulnerability in n/a, published on 17 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass. The security control that the application currently has in place is a simple Username and Password authentication function. Using enumeration, an attacker is able to forge a User specific token without the need for correct password to gain access to the mobile application as that victim user.
Weakness: CWE-287
Which versions are affected by CVE-2020-27199?
It affects 1 product.
Products include Magic Home Pro Project Magic Home Pro.
How do I fix CVE-2020-27199?
No fix has been published for CVE-2020-27199 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-27199 being exploited?
There is no known exploitation of CVE-2020-27199 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-3r7g-xhpj-j87w.