# CVE-2024-21494: GO-2024-2558 - Authentication Bypass by Spoofing in github.com/greenpau/caddy-security

Source: https://junglewise.ai/threats/cve-2024-21494-authentication-bypass-by-spoofing-in-github-com-greenpau-caddy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-06-28  
License: CC BY 4.0 with a link back

CVE-2024-21494 · Severity: low · CVSS 3.1 · Published 2024-06-28

Authentication Bypass by Spoofing in github.com/greenpau/caddy-security

Technologies: [github.com/greenpau/caddy-security (Go)](https://junglewise.ai/threats/technologies/github-com-greenpau-caddy-security). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2024-21494 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-21494 being exploited in the wild.

**How severe is CVE-2024-21494?** Low severity, with a CVSS score of 3.1, published 28 June 2024.

**Which products and versions are affected?** github.com/greenpau/caddy-security (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.23.

**Is there a fix for CVE-2024-21494?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2024-21494?** Check whether you run github.com/greenpau/caddy-security (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- github.com/greenpau/caddy-security (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.23

## Identifiers

- CVE-2024-21494
- GHSA-vj36-3ccr-6563
- GO-2024-2558

## Related threats

- [GO-2024-2562 - Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security](https://junglewise.ai/threats/cve-2024-21499-improper-neutralization-of-http-headers-in-github-com-greenpau)
- [GO-2024-2557 - Insufficient Session Expiration in github.com/greenpau/caddy-security](https://junglewise.ai/threats/cve-2024-21492-insufficient-session-expiration-in-github-com-greenpau-caddy)
- [GO-2024-2559 - Cross-site Scripting in github.com/greenpau/caddy-security](https://junglewise.ai/threats/cve-2024-21496-cross-site-scripting-in-github-com-greenpau-caddy-security)
- [GO-2024-2564 - Improper Validation of Array Index in github.com/greenpau/caddy-security](https://junglewise.ai/threats/cve-2024-21493-improper-validation-of-array-index-in-github-com-greenpau-caddy)
- [GO-2024-2549 - caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting in github.com/greenpau/caddy-security](https://junglewise.ai/threats/cve-2023-52430-caddy-security-plugin-for-caddy-vulnerable-to-reflected-cross)