Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.

Related CVEs

CVE-2024-6890

Key Information

GHSA ID

GHSA-4rc5-7v2h-gq36

Published

August 8, 2024 12:31 AM

Last Modified

August 8, 2024 3:31 PM

CVSS Score

9.0 /10

Primary Ecosystem

Unknown

Primary Package

Unknown

GitHub Reviewed

✗ No

Dataset

Last updated: July 27, 2025 6:35 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.