CVE-2020-24876: Pancakeapp Pancake

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

Use of a hard-coded cryptographic key in Pancake versions < 4.13.29 allows an attacker to forge session cookies, which may lead to remote privilege escalation.

Affected products

• Pancakeapp Pancake: before 4.13.29 (fixed in 4.13.29)

Published 2020-09-03. Last modified 2026-06-17.