CVE-2024-45404 OpenCTI's lack of Rate Limit lead to OTP brute forcing

What is CVE-2024-45404?

CVE-2024-45404 is a high-severity authentication bypass vulnerability in OpenCTI-Platform opencti, published on 11 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can break through the two-factor authentication and hijack the account. This is because the otpLogin mutation does not implement One Time Password rate limiting. As of time of publication, it is unknown whether a patch is available.

Weakness: CWE-307, CWE-287

Which versions are affected by CVE-2024-45404?

1 open source package ship an affected version, including pycti. It affects 1 product.

Products include Citeum Opencti.

How do I fix CVE-2024-45404?

Upgrade pycti to 6.2.18 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-45404 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45404 exists.

Other vulnerabilities in OpenCTI-Platform opencti

• CVE-2026-27960 OpenCTI privilege escalation and unauthenticated access via default admin account Critical 9.8
• CVE-2026-39980 OpenCTI affected by RCE via notifier template Critical 9.1
• CVE-2025-24977 OpenCTI has remote code execution and sensitive secrets exposed through web hook Critical 9.1
• CVE-2024-26139 OpenCTI Authenticated Privilege Escalation High 8.3
• CVE-2026-21887 OpenCTI has a Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hg56-r6hh-56j7, PYSEC-2024-297.