CVE-2024-48916
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-07-30

Last updated on: 2025-07-31

Assigner: GitHub, Inc.

Description
Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-07-30
Last Modified
2025-07-31
Generated
2026-05-07
AI Q&A
2025-07-30
EPSS Evaluated
2026-05-05
NVD
CVE-2024-48916
EUVD
EUVD-2024-54839
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
ceph ceph_radosgw *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in Ceph versions 19.2.3 and below allows an attacker to send a JSON Web Token (JWT) with the algorithm set to "none", which causes the system to skip signature verification. This flaw is likely in the RadosGW OIDC provider, enabling potentially unauthorized access because the JWT signature is not checked.


How can this vulnerability impact me? :

The vulnerability can lead to unauthorized access or privilege escalation since attackers can bypass JWT signature verification. This can compromise confidentiality and integrity of data within the Ceph storage platform, potentially allowing attackers to impersonate users or gain elevated permissions.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart