CVE-2024-30173
OpenID Connect Authentication (oidc) Typo3 extension Authentication Bypass
The authentication service of the extension does not verify the OpenID Connect authentication state from the user lookup chain. Instead, the authentication service authenticates every valid frontend user from the user lookup chain, where the frontend user field “tx_oidc” is not empty.
In scenarios, where either ext:felogin is active or where $GLOBALS['TYPO3_CONF_VARS'][‘FE’][‘checkFeUserPid’] is disabled, an attacker can login to OpenID Connect frontend user accounts by providing a valid username and any password.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score usedGHSA-hhf8-f5w9-g6vh
OpenID Connect Authentication (oidc) Typo3 extension Authentication Bypass
The authentication service of the extension does not verify the OpenID Connect authentication state from the user lookup chain. Instead, the authentication service authenticates every valid frontend user from the user lookup chain, where the frontend user field “tx_oidc” is not empty.
In scenarios, where either ext:felogin is active or where $GLOBALS['TYPO3_CONF_VARS'][‘FE’][‘checkFeUserPid’] is disabled, an attacker can login to OpenID Connect frontend user accounts by providing a valid username and any password.
- Record
GHSA-hhf8-f5w9-g6vh- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N/E:F/RL:O/RC:C - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-hhf8-f5w9-g6vh
OpenID Connect Authentication (oidc) Typo3 extension Authentication Bypass
The authentication service of the extension does not verify the OpenID Connect authentication state from the user lookup chain. Instead, the authentication service authenticates every valid frontend user from the user lookup chain, where the frontend user field “tx_oidc” is not empty.
In scenarios, where either ext:felogin is active or where $GLOBALS['TYPO3_CONF_VARS'][‘FE’][‘checkFeUserPid’] is disabled, an attacker can login to OpenID Connect frontend user accounts by providing a valid username and any password.
- Record
GHSA-hhf8-f5w9-g6vh- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N/E:F/RL:O/RC:C - Weakness
- CWE-284
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
causal/oidcPackagist |
before 2.1.0 | 2.1.0 |
causal/oidcPackagist |
before 2.1.0, plus listed versions 0.1.00.2.00.5.01.0.01.1.01.2.02.0.0 |
2.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-30173 is a medium vulnerability (CVSS 6.0) in causal/oidc, published April 2, 2024. No source lists public exploit code. Fixed in causal/oidc 2.1.0.