CVE-2024-46937: Mfasoft Secure Authentication Server

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

An improper access control (IDOR) vulnerability in the /api-selfportal/get-info-token-properties endpoint in MFASOFT Secure Authentication Server (SAS) 1.8.x through 1.9.x before 1.9.040924 allows remote attackers gain access to user tokens without authentication. The is a brute-force attack on the serial parameter by number identifier: GA00001, GA00002, GA00003, etc.

Affected products

• Mfasoft Secure Authentication Server: from 1.8.0, before 1.9.040924 (fixed in 1.9.040924)

Published 2024-09-16. Last modified 2026-06-17.