CVE-2023-23929
Refresh tokens do not expire in Vantage6
Summary
Refresh tokens do not expire in Vantage6
Original description
The description as published by the source.
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
PyPI
vantage6
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0"}]}]
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- web github.com