Go/github.com/ory/kratos CVE-2024-45042: unknown, EPSS 0.33%

Ory Kratos's setting required_aal `highest_available` does not properly respect code + mfa credentials in github.com/ory/kratos

Action: Upgrade github.com/ory/kratos to 1.3.0 or later.

go get github.com/ory/kratos@v1.3.0

Affected

Fixed versions

Sources

• osv: GO-2024-3160
• https://github.com/ory/kratos/security/advisories/GHSA-wc43-73w7-x2f5

CVE-2024-45042 · published 2024-09-26T18:24:03Z · modified 2026-03-03T04:52:02.769502Z · JSON