CVE-2024-11217

MediumCVSS 4.9

Published: 15/11/2024(UTC)Updated: 26/06/2026(UTC)Translated: 27/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

A vulnerability in the OAuth-server causes OAuth2 client secrets to be logged when the log level is set to Debug or higher for OIDC/GitHub/GitLab/Google login options.

Risk Assessment

Exposure of client secrets may allow an attacker to impersonate the application and take over user sessions.

Recommendation

It is recommended to set the log level below Debug in production environments and regularly review logs for secret leaks.

Original NVD description (English source)

A vulnerability was found in the OAuth-server. OAuth-server logs the OAuth2 client secret when the logLevel is Debug higher for OIDC/GitHub/GitLab/Google IDPs login options.