CVE-2024-21500

CVE-2024-21500 is a medium-severity vulnerability affecting all versions of the github.com/greenpau/caddy-security package, including authcrunch caddy-security. It allows attackers to bypass two-factor authentication (2FA) lockout mechanisms by automating the full multi-step 2FA process, despite the application's attempt to block users after failed attempts. The vulnerability has a CVSS score of 6.5, indicating a network-based attack with low complexity, requiring no user interaction or privileges, and potentially leading to partial confidentiality and integrity compromise. There is currently no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.