https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 10:37:23 +0000 https://cve.radiocsirt.org/vuln/cve-2024-23674 <p><strong>Affected:</strong> ausweisapp online-ausweis-funktion</p> <p>The Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 allows authentication bypass by spoofing. A man-in-the-middle attacker can assume a victim&#39;s identify for access to government, medical, and financial resources, and can also extract personal data from the card, aka the &#34;sPACE (Spoofing Password Authenticated Connection Establishment)&#34; issue. This occurs because of a combination of factors, such as insecure PIN entry (for basic readers) and eid:// deeplinking. The victim must be using a modified eID kernel, which may occur if the victim is tricked into installing a fake version of an official app. NOTE: the BSI position is &#34;ensuring a secure operational environment at the client side is an obligation of the ID card owner.&#34;</p> <p><strong>Affected:</strong> ausweisapp online-ausweis-funktion</p> <p>The Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 allows authentication bypass by spoofing. A man-in-the-middle attacker can assume a victim&#39;s identify for access to government, medical, and financial resources, and can also extract personal data from the card, aka the &#34;sPACE (Spoofing Password Authenticated Connection Establishment)&#34; issue. This occurs because of a combination of factors, such as insecure PIN entry (for basic readers) and eid:// deeplinking. The victim must be using a modified eID kernel, which may occur if the victim is tricked into installing a fake version of an official app. NOTE: the BSI position is &#34;ensuring a secure operational environment at the client side is an obligation of the ID card owner.&#34;</p> https://cve.radiocsirt.org/vuln/cve-2024-23674