CVE-2024-24825: Open Source Vulnerability in dirac Package - TokenManager Permissions Check
Summary
CVE-2024-24825: DIRAC's TokenManager does not check permissions on cached tokens. Affects dirac across 2 version ranges.
>= 8.0.0, < 8.0.37
< 8.0.37
Fixed in 8.0.37. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The dirac package is an open-source Python package available on PyPI. It provides functionality for managing tokens in a distributed system. The TokenManager component is responsible for handling token requests and caching them for future use. However, a vulnerability has been identified in the TokenManager that allows any user to obtain a token that has been requested by another user or agent. This vulnerability affects versions 8.0.0 to 8.0.36 of the dirac package.
Vulnerability Detail
The vulnerability arises from the TokenManager's failure to check permissions on cached tokens. As a result, any user can retrieve a token that was originally requested by another user or agent. This can lead to unauthorized access and potential misuse of the token, compromising the security and integrity of the system. The vulnerability has been assigned a CVSS score of 9.1, indicating a critical severity level.
How To Fix
Latest published version: 9.1.21 as of 22 Oct 2026
pip install --upgrade "dirac==9.1.21"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.0.37
This is the first release that contains the fix.
pip install --upgrade "dirac==8.0.37"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to update the dirac package to the fixed version to mitigate the risk.
Conclusion
In conclusion, the dirac package is vulnerable to an issue in its TokenManager component that allows unauthorized access to cached tokens. To mitigate this vulnerability, it is recommended to update the package to version 8.0.37 or later. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for dirac →
FAQ
The vulnerability allows any user to obtain a token that was originally requested by another user or agent. This can lead to unauthorized access and potential misuse of the token, compromising the security and integrity of the system.
Versions 8.0.0 to 8.0.36 of the dirac package are affected by this vulnerability.
Yes, the vulnerability has been fixed in version 8.0.37 of the dirac package.
No, there are no known workarounds for this vulnerability. It is crucial to update the dirac package to the fixed version.
The vulnerability has been assigned a CVSS score of 9.1, indicating a critical severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for dirac.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
