CVE-2024-48916
Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not chec...
Affects 0 products across 3 vendors.
Show all 12
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
CVE-2024-48916 affects Ceph versions 19.2.3 and below, allowing an attacker to send a JWT with 'none' as the algorithm, bypassing signature verification in the RadosGW OIDC provider.
BSID: BS-2025-GLOBAL-216442-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2024-48916?
What is the CVSS score for CVE-2024-48916?
Is CVE-2024-48916 actively exploited?
How do I remediate CVE-2024-48916?
What systems are affected by CVE-2024-48916?
| CVE ID | CVE-2024-48916 |
|---|---|
| BSID | BS-2025-GLOBAL-216442-H BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| Published | 2025-07-30 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 0% |
| Weakness (CWE) | |
| Source | NVD |
Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.
Source: NIST NVD / MITRE CVE Database
An attacker can craft a JWT with the 'none' algorithm, which is not supposed to be used in production environments. This allows the attacker to send unsigned tokens that are accepted as valid by the RadosGW OIDC provider, potentially leading to unauthorized access.
Exploitation Likelihood: HIGH
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 2d5dd03ce0505021e5e2b5f6a6d4ce1a4366deb51734f84c2e510a3729f028752757d491b5c2de68831edfbc17a60db5bcd4a4bd6c250e78083b826b645e935f |
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.
Create a free account →