Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2023-23929

Refresh tokens do not expire in Vantage6

Description

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

vantage6 vantage6

  • < 3.8.0affected

References