CVE-2024-37893
Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malic...
Affects 0 products across 1 vendor.
Software does not prove or insufficiently proves that the user is who they claim to be.
Show all 12
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
Firefly III, a free and open source personal finance manager, is vulnerable to an MFA bypass in its OAuth flow, allowing attackers to bypass multi-factor authentication and potentially gain unauthorized access to user data through password spraying.
BSID: BS-2024-GLOBAL-197591-M • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2024-37893?
What is the CVSS score for CVE-2024-37893?
Is CVE-2024-37893 actively exploited?
How do I remediate CVE-2024-37893?
What systems are affected by CVE-2024-37893?
| CVE ID | CVE-2024-37893 |
|---|---|
| BSID | BS-2024-GLOBAL-197591-M BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Published | 2024-06-17 |
| Last Modified | 2026-04-15 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to Firefly III data using passwords stolen from other sources. As OAuth applications are easily enumerable using an incrementing id, an attacker could try sign an OAuth application up to a users profile quite easily if they have created one. The attacker would also need to know the victims username and password. This problem has been patched in Firefly III v6.1.17 and up. Users are advised to upgrade. Users unable to upgrade should Use a unique password for their Firefly III instance and store their password securely, i.e. in a password manager.
Source: NIST NVD / MITRE CVE Database
The vulnerability lies in the OAuth flow of Firefly III, where an attacker can bypass the multi-factor authentication (MFA) check. This enables the attacker to use password spraying techniques with stolen passwords from other sources to gain access to user accounts.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Fixed Version |
|---|---|---|
| Firefly | — | — |
No patch URL on record. Monitor vendor security advisories directly.
| CISA KEV | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
SAGE Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | MEDIUM |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | d54cf24880b236ba00564093f7d3390c9c025ce826a7ea76e8fd59788dc6936eff5dba9fccfbf91348a9e7f0d1dedff9102339dff5006bd8c39caeebbd834136 |
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider monitors 353,228 CVEs across ICS/OT vendors. SAGE-enriched alerts with virtual patches, NERC-CIP mapping, and PSIRT contacts delivered to your SIEM in minutes.
Join free →