Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

go.thethings.network/lorawan-stack/v3

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.1GoPublished

    lorawan-stack Open Redirect vulnerability

    CVE-2023-26494 · GHSA-5fwq-9x7j-2qpg

    Affected
    • Go go.thethings.network/lorawan-stack/v3 < 3.24.1
    Fixed in
    3.24.1· Vendor fix available
    Issue
    lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may allows malicious actors to phish users, as users assume they were redirected to the homepage on login. Version 3.24.1 contains a fix.

    Recommended action: Upgrade to 3.24.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →