CVE-2021-36460 Auth bypass in n/a
An attacker with a stolen local password hash can take over user accounts because the app uses the hash directly for backend authentication.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-36460?
CVE-2021-36460 is a high-severity authentication bypass vulnerability in n/a, published on 25 Apr 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user's account, rendering the benefits of storing hashed passwords in the database useless.
Weakness: CWE-287
Which versions are affected by CVE-2021-36460?
It affects 1 product.
Products include Veryfitpro Project Veryfitpro.
How do I fix CVE-2021-36460?
No fix has been published for CVE-2021-36460 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-36460 being exploited?
There is no known exploitation of CVE-2021-36460 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-4jxf-pjgf-g7fc.