CVE-2023-23929
Refresh tokens do not expire in Vantage6
CVE-2023-23929 is a high vulnerability (CVSS 8.8) in Vantage6, published February 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in vantage6 3.8.0.
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Refresh tokens do not expire in Vantage6
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.
- Record
CVE-2023-23929- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-613
- Updated
- 2026-11-02
EUVDEUVD-2023-0262
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.
- Record
EUVD-2023-0262- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4w59-c3gc-rrhp
vantage6 refresh tokens do not expire
From issue:
Problem description Currently, the refresh token is valid indefinitely. This is bad security practice.
Desired solution The refresh token should get a validity of 24-48 hours.
Additional context
When implementing this, also check that the refresh token returns a new refresh token When implementing this, also adapt the UI so that it logs out if refresh token is no longer valid. When implementing this, ensure that nodes refresh their token periodically so that they do not have to be restarted manually.
Impact
Patches
None available
Workarounds
None available
- Record
GHSA-4w59-c3gc-rrhp- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-613
- Updated
- 2026-11-02
NVD
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.
- Record
CVE-2023-23929- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-613
- Updated
- 2026-11-02
OSV
Refresh tokens do not expire in Vantage6
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.
- Record
CVE-2023-23929- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-613
- Updated
- 2026-11-02
OSVGHSA-4w59-c3gc-rrhp
vantage6 refresh tokens do not expire
From issue:
Problem description Currently, the refresh token is valid indefinitely. This is bad security practice.
Desired solution The refresh token should get a validity of 24-48 hours.
Additional context
When implementing this, also check that the refresh token returns a new refresh token When implementing this, also adapt the UI so that it logs out if refresh token is no longer valid. When implementing this, ensure that nodes refresh their token periodically so that they do not have to be restarted manually.
Impact
Patches
None available
Workarounds
None available
- Record
GHSA-4w59-c3gc-rrhp- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-613
- Updated
- 2026-11-02
OSVPYSEC-2023-54 No score
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.
- Record
PYSEC-2023-54- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vantage6PyPI |
before 3.8.0 | 3.8.0 |
vantage6PyPI |
before 3.8.0, plus listed versions 0.0.00.0.0b00.0.0b10.0.0b31.0.0 Show 45 moreShow less1.0.0a11.0.0a21.0.0b101.0.0b111.0.0b121.0.0b131.0.0b141.0.0b21.0.0b31.0.0b41.0.0b51.0.0b61.0.0b71.0.0b81.0.0b91.1.01.1.0rc11.1.0rc21.2.01.2.11.2.21.2.31.2.3.post22.0.02.0.0.post12.0.0a12.0.0a22.0.0a32.0.1rc12.0.1rc22.1.02.1.0rc12.1.12.2.02.2.0b12.2.0b22.2.0b32.2.0b42.2.12.2.102.2.112.2.122.2.22.2.32.2.4 |
3.8.0 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
github.com/vantage6/vantage6/security/advisories/GHSA-4w59-c3gc-rrhp
nvd.nist.gov/vuln/detail/CVE-2023-23929
Left out here: 100 versions. The JSON record has them.