CVE-2018-1000809
privacyIDEA Improper Input Validation vulnerability
privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.
- Record
CVE-2018-1000809- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.
- Record
CVE-2018-1000809- Updated
- 2026-11-02
EUVDEUVD-2018-0117 No score
privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.
- Record
EUVD-2018-0117- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7qqv-r2q4-jxhm
privacyIDEA Improper Input Validation vulnerability
privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.
- Record
GHSA-7qqv-r2q4-jxhm- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.
- Record
CVE-2018-1000809- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-7qqv-r2q4-jxhm
privacyIDEA Improper Input Validation vulnerability
privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.
- Record
GHSA-7qqv-r2q4-jxhm- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVPYSEC-2018-20 No score
privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.
- Record
PYSEC-2018-20- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
privacyideaPyPI |
before 2.23.2 | 2.23.2 |
privacyideaPyPI |
before 2.23.2, plus listed versions 1.01.0dev41.0dev51.0dev61.0dev7 Show 45 moreShow less1.11.21.2.11.2.1-dev01.2.21.2.31.31.3.11.3.21.3.31.41.4.11.4dev51.51.5.11.5.1.12.02.0.12.0dev12.12.102.10.12.10.22.10dev22.10dev42.10dev52.10dev62.112.11.12.11.22.11.32.11dev22.122.12.12.132.142.152.162.16.12.172.17.dev42.17.dev52.17.dev62.182.18.1 |
2.23.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000809 is a high vulnerability (CVSS 7.5) in Privacyidea, published October 8, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.69%, the 77th percentile. Fixed in privacyidea 2.23.2.
References
github.com/privacyidea/privacyidea/commit/a3edc09beffa2104f357fe24971ea3211ce40751
nvd.nist.gov/vuln/detail/CVE-2018-1000809
Left out here: 61 versions. The JSON record has them.