PT-2025-40019 · Corezoid · Corezoid

Published 2025-09-30 · Updated 2025-12-23 · CVE-2024-55017

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Corezoid version 6.6.0

Description An issue exists in the OAuth2 implementation of Corezoid that allows for account takeover. The vulnerability is due to an open redirect within the redirect uri parameter. This allows attackers to intercept authorization codes and gain unauthorized access to victim accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-55017

Affected Products

Corezoid

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-55017 · Security Note
• https://osv.dev/vulnerability/CVE-2024-55017 · Vendor Advisory
• https://github.com/corezoid/helm · Note
• https://t.me/CVEtracker/33758 · Telegram Post
• https://twitter.com/CVEnew/status/2003567332711395787 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1973199698740629545 · Twitter Post
• https://medium.com/@elmiraibrahimlii/corezoid-cve-2024-55017-account-takeover-via-oauth2-redirect-uri-open-redirect-9dd78bc337a3 · Note