CVE-2024-45394

CVE-2024-45394 affects the Authenticator browser extension, specifically versions 7.0.0 and below. The vulnerability stems from weak encryption key derivation for user data, utilizing only AES-256 and EVP_BytesToKey, which allows an attacker with access to a user's encrypted data to brute-force the encryption key. This is a high-severity vulnerability (CVSS 7.8) with a local attack vector and low attack complexity, potentially leading to full compromise of confidentiality, integrity, and availability of user data. Users on version 8.0.0 and above are automatically migrated, but older encrypted backups remain vulnerable. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE. It is not listed in the KEV catalog or Hot List.