CVE-2024-24771

CVE-2024-24771 describes a non-exploitable multi-factor authentication weakness in Open Forms versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2. This vulnerability could theoretically allow an attacker to bypass 2FA for superusers if their credentials were compromised and the attacker could authenticate to Open Forms through a misconfigured API endpoint. The CVSS score is 5.9 (Medium), indicating a high impact on confidentiality and integrity, but with high attack complexity and requiring high privileges. Despite the theoretical bypass, the maintainers believe exploitation is not possible due to multiple mitigating factors, and there is no evidence of active exploitation, public exploit code, or significant community discussion.