CVE-2022-3614: Octopus Server

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirected to the configured redirect url without any validation.

Affected products

• Octopus Octopus Server: from 3.5, before 2022.3.10750 (fixed in 2022.3.10750); from 2022.4, before 2022.4.8063 (fixed in 2022.4.8063)

Published 2023-01-03. Last modified 2026-06-17.