CVE-2024-36048
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through...
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.
- Record
CVE-2024-36048- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-335
- Updated
- 2026-11-02
EUVDEUVD-2024-35852
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.
- Record
EUVD-2024-35852- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r8x8-rv8c-j266
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through...
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.
- Record
GHSA-r8x8-rv8c-j266- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-335
- Updated
- 2026-11-02
NVD
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.
- Record
CVE-2024-36048- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-335
- Updated
- 2026-11-02
OSV
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.
- Record
CVE-2024-36048- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-36048
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.
- Record
DEBIAN-CVE-2024-36048- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVOESA-2025-1140
qt5-qtnetworkauth security update
Qt5 - NetworkAuth component
Security Fix(es):
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.(CVE-2024-36048)
- Record
OESA-2025-1140- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1141
qt5-qtnetworkauth security update
Qt5 - NetworkAuth component
Security Fix(es):
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.(CVE-2024-36048)
- Record
OESA-2025-1141- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1142
qt6-qtnetworkauth security update
Qt6 - NetworkAuth component
Security Fix(es):
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.(CVE-2024-36048)
- Record
OESA-2025-1142- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1143
qt6-qtnetworkauth security update
Qt6 - NetworkAuth component
Security Fix(es):
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.(CVE-2024-36048)
- Record
OESA-2025-1143- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-36048
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.
- Record
UBUNTU-CVE-2024-36048- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2024-0197No score
Updated qtnetworkauth5 & qtnetworkauth6 packages fix security vulnerability
QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.
- Record
MGASA-2024-0197- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:0138-1No score
Security update for qt6-networkauth
This update for qt6-networkauth fixes the following issues:
- CVE-2024-36048: Fixed data race and poor seeding in generateRandomString() (boo#1224782).
- Record
openSUSE-SU-2024:0138-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:0143-1No score
Security update for libqt5-qtnetworkauth
This update for libqt5-qtnetworkauth fixes the following issues:
- CVE-2024-36048: Fixed data race and poor seeding in generateRandomString() (boo#1224782).
- Record
openSUSE-SU-2024:0143-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14003-1No score
libQt6NetworkAuth6-6.7.1-1.1 on GA media
These are all security issues fixed in the libQt6NetworkAuth6-6.7.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14003-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14006-1No score
libQt5NetworkAuth5-5.15.13+kde1-1.1 on GA media
These are all security issues fixed in the libQt5NetworkAuth5-5.15.13+kde1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14006-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qt6-networkauthDebian:12 | All versions, plus listed versions 6.10.2-16.10.2-26.10.2-36.11.2-16.11.2-2 Show 21 moreShow less6.4.2-16.4.2-26.4.2-36.4.2-46.4.2-56.6.1-16.6.1-26.6.2-16.6.2-26.7.2-16.7.2-26.8.2-16.8.2-26.8.2-36.8.2-46.9.1-16.9.1-26.9.1-36.9.2-16.9.2-26.9.2-3 | None known |
qt6-networkauthDebian:13 | before 6.7.2-2 | 6.7.2-2 |
qt6-networkauthDebian:14 | before 6.7.2-2 | 6.7.2-2 |
qtnetworkauth-everywhere-srcDebian:12 | All versions, plus listed versions 5.15.10-15.15.10-25.15.12-15.15.13-15.15.13-2 Show 11 moreShow less5.15.13-35.15.15-15.15.15-25.15.15-35.15.17-15.15.17-25.15.18-15.15.19-15.15.19-25.15.8-25.15.9-1 | None known |
qtnetworkauth-everywhere-srcDebian:13 | before 5.15.13-3 | 5.15.13-3 |
qtnetworkauth-everywhere-srcDebian:14 | before 5.15.13-3 | 5.15.13-3 |
qtnetworkauth5Mageia:9 | before 5.15.7-1.1.mga9 | 5.15.7-1.1.mga9 |
qtnetworkauth6Mageia:9 | before 6.4.1-1.1.mga9 | 6.4.1-1.1.mga9 |
qt5-qtnetworkauthopenEuler:24.03-LTS-SP1 | before 5.15.10-2.oe2403sp1 | 5.15.10-2.oe2403sp1 |
qt5-qtnetworkauthopenEuler:24.03-LTS | before 5.15.10-2.oe2403 | 5.15.10-2.oe2403 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qt6-qtnetworkauthopenEuler:24.03-LTS | before 6.5.2-2.oe2403 | 6.5.2-2.oe2403 |
qt6-qtnetworkauthopenEuler:24.03-LTS-SP1 | before 6.5.2-2.oe2403sp1 | 6.5.2-2.oe2403sp1 |
qtnetworkauth-everywhere-srcUbuntu:20.04:LTS | All versions, plus listed versions 5.12.4-15.12.5-15.12.8-0ubuntu1 | None known |
qtnetworkauth-everywhere-srcUbuntu:22.04:LTS | All versions, plus listed versions 5.15.2-25.15.3-1 | None known |
qtnetworkauth-everywhere-srcUbuntu:24.04:LTS | All versions, plus listed versions 5.15.10-25.15.12-15.15.12-1build15.15.12-1build25.15.13-1 | None known |
qtnetworkauth-everywhere-srcUbuntu:25.10 | All versions, plus listed versions 5.15.15-35.15.17-1 | None known |
qtnetworkauth-everywhere-srcUbuntu:26.10 | All versions, plus listed versions 5.15.18-15.15.19-2 | None known |
qtnetworkauth-everywhere-srcUbuntu:26.04:LTS | All versions, plus listed versions 5.15.17-15.15.17-25.15.18-1 | None known |
qt6-networkauthSUSE:Package Hub 15 SP5 | before 6.4.2-bp155.2.3.1 | 6.4.2-bp155.2.3.1 |
qt6-networkauth-docsSUSE:Package Hub 15 SP5 | before 6.4.2-bp155.2.3.1 | 6.4.2-bp155.2.3.1 |
qt6-networkauthopenSUSE:Leap 15.5 | before 6.4.2-bp155.2.3.1 | 6.4.2-bp155.2.3.1 |
qt6-networkauth-docsopenSUSE:Leap 15.5 | before 6.4.2-bp155.2.3.1 | 6.4.2-bp155.2.3.1 |
libqt5-qtnetworkauthSUSE:Package Hub 15 SP5 | before 5.15.2+kde2-bp155.3.3.1 | 5.15.2+kde2-bp155.3.3.1 |
libqt5-qtnetworkauthopenSUSE:Leap 15.5 | before 5.15.2+kde2-bp155.3.3.1 | 5.15.2+kde2-bp155.3.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-36048 is a critical vulnerability (CVSS 9.8) in Qt, published May 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 62nd percentile. Fixed in qt6-networkauth 6.7.2-2.
References
codereview.qt-project.org/c/qt/qtnetworkauth/+/560317
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGB6KUPJFQWUBKXVDPJUMAD6KNJJEWPW
Show 19 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-36048
github.com/advisories/GHSA-r8x8-rv8c-j266
security-tracker.debian.org/tracker/CVE-2024-36048
advisories.mageia.org/MGASA-2024-0197.html
bugs.mageia.org/show_bug.cgi?id=33247
lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/55ZLZN7U7KUGQ7YANJIPQP7R7ESP6B3L
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1140
ubuntu.com/security/CVE-2024-36048
cve.org/CVERecord?id=CVE-2024-36048
bugzilla.suse.com/1224782
suse.com/security/cve/CVE-2024-36048