-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper group membership validation during token renewal/login. The commit diff shows critical changes in these functions where conditional checks for GroupAliases presence were removed. This matches the CVE description about failing to remove invalid group memberships. The test additions in identity_test.go validate() these scenarios, confirming these functions were central to the privilege management flaw.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hashicorp/vault | go | >= 0.9.0, < 1.3.4 | 1.3.4 |
GoGoOngoing coverage of React2Shell