What is CVE-2020-8791?

CVE-2020-8791 is a medium-severity vulnerability in Oklok Project, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2020-05-04.

How severe is CVE-2020-8791?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2020-8791 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Oklok Project

CVE-2020-8791

The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) allows remote attackers to submit API requests using authenticated but unauthorized tokens, resulting in IDOR issues. A remote attacker can use their own token to make unauthorized API requests on behalf of arbitrary user IDs. Valid and current user IDs are trivial to guess because of the user ID assignment convention used by the app. A remote attacker could harvest email addresses, unsalted MD5 password hashes, owner-assigned lock names, and owner-assigned fingerprint names for any range of arbitrary user IDs.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.010 (59.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Oklok_project Oklok — versions 3.1.1
N/a — versions n/a

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

Public proof-of-concept exploits

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-8791?: CVE-2020-8791 is a medium-severity vulnerability in Oklok Project, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2020-05-04.
How severe is CVE-2020-8791?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2020-8791 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.