{"api_version":"1","generated_at":"2026-07-23T03:37:29+00:00","cve":"CVE-2023-28126","urls":{"html":"https://cve.report/CVE-2023-28126","api":"https://cve.report/api/cve/CVE-2023-28126.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-28126","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-28126"},"summary":{"title":"CVE-2023-28126","description":"An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser method or can exploit the Race Condition in the authentication message.","state":"PUBLIC","assigner":"support@hackerone.com","published_at":"2023-05-09 22:15:00","updated_at":"2023-05-16 18:24:00"},"problem_types":["CWE-362"],"metrics":[],"references":[{"url":"https://forums.ivanti.com/s/article/ZDI-CAN-17750-Ivanti-Avalanche-EnterpriseServer-GetSettings-Exposed-Dangerous-Method-Authentication-Bypass-Vulnerability?language=en_US","name":"https://forums.ivanti.com/s/article/ZDI-CAN-17750-Ivanti-Avalanche-EnterpriseServer-GetSettings-Exposed-Dangerous-Method-Authentication-Bypass-Vulnerability?language=en_US","refsource":"MISC","tags":[],"title":"Ivanti Community","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28126","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28126","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2023","cve_id":"28126","vulnerable":"1","versionEndIncluding":"6.3.4.153","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ivanti","cpe5":"avalanche","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"premise","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2023-28126","ASSIGNER":"support@hackerone.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"n/a","product":{"product_data":[{"product_name":"Avalanche","version":{"version_data":[{"version_value":"Avalanche versions 6.3.x and below"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Authentication Bypass by Primary Weakness (CWE-305)"}]}]},"references":{"reference_data":[{"refsource":"MISC","name":"https://forums.ivanti.com/s/article/ZDI-CAN-17750-Ivanti-Avalanche-EnterpriseServer-GetSettings-Exposed-Dangerous-Method-Authentication-Bypass-Vulnerability?language=en_US","url":"https://forums.ivanti.com/s/article/ZDI-CAN-17750-Ivanti-Avalanche-EnterpriseServer-GetSettings-Exposed-Dangerous-Method-Authentication-Bypass-Vulnerability?language=en_US"}]},"description":{"description_data":[{"lang":"eng","value":"An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser method or can exploit the Race Condition in the authentication message."}]}},"nvd":{"publishedDate":"2023-05-09 22:15:00","lastModifiedDate":"2023-05-16 18:24:00","problem_types":["CWE-362"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.2,"impactScore":3.6}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ivanti:avalanche:*:*:*:*:premise:*:*:*","versionEndIncluding":"6.3.4.153","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}