CVE-2024-21654

CVE-2024-21654 is a critical authentication bypass vulnerability affecting Rubygems.org, allowing attackers to circumvent multi-factor authentication (MFA) during a forgotten password workflow. This flaw enables full account takeover even if a user's email account is compromised, impacting the integrity and availability of user accounts on the platform. With a CVSS score of 9.8 (Critical), the vulnerability is easily exploitable over the network without user interaction, leading to high confidentiality, integrity, and availability impacts. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.