CVE-2024-56325

CVE-2024-56325 is a critical authentication bypass vulnerability affecting Apache Pinot versions prior to 1.3.0. An attacker can create new users with administrative privileges by crafting a malicious request that includes a period in the URL path, bypassing normal authentication mechanisms. This flaw carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low complexity, and high impact on confidentiality, integrity, and availability, allowing full control over Pinot. While not yet observed in active exploitation or listed in CISA's KEV catalog, public Nuclei templates exist for detecting this vulnerability, and its EPSS score indicates a higher than average probability of exploitation.