CVE-2024-12368: Odoo Authentication Bypass Vulnerability

CVE-2024-12368 Overview

CVE-2024-12368 is an improper access control vulnerability [CWE-284] in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0. The flaw allows an authenticated internal user to export the OAuth tokens belonging to other users of the same instance. An attacker who obtains these tokens can impersonate the affected users against any OAuth-integrated service, bypassing authentication controls on downstream systems.

Critical Impact
An authenticated Odoo user can exfiltrate OAuth tokens of other users, enabling account takeover across federated services connected through the auth_oauth module.

Affected Products

Odoo Community 15.0
Odoo Enterprise 15.0
Deployments using the auth_oauth authentication module

Discovery Timeline

2025-02-25 - CVE-2024-12368 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12368

Vulnerability Analysis

The vulnerability resides in the auth_oauth module, which handles OAuth-based authentication in Odoo 15.0. The module stores OAuth access tokens on user records, and access control on these fields is not properly enforced. An internal user with basic read access to user records can retrieve OAuth token values that should be restricted to the token owner and administrators.

OAuth tokens function as bearer credentials for third-party services such as Google Workspace, Microsoft 365, or custom identity providers integrated with Odoo. Once exported, a token remains valid for the lifetime configured by the issuing identity provider. Attackers can replay these tokens outside of Odoo to access mail, calendars, storage, or other resources scoped to the compromised user.

Root Cause

The root cause is missing or insufficient access control [CWE-284] on OAuth token fields exposed through Odoo's ORM. Odoo relies on record rules and field-level access control lists to restrict sensitive data, and the auth_oauth module did not apply the necessary restrictions to the token attribute. Standard export functionality then treats the field like any other readable value.

Attack Vector

Exploitation requires network access to the Odoo instance and valid credentials for any internal user account. The attacker uses the standard web UI or XML-RPC/JSON-RPC API to read or export the res.users model, including the OAuth token field. No user interaction from the victim is required, and the operation leaves the same audit trail as any normal record export. Refer to the GitHub Odoo Issue Discussion for community technical context.

Detection Methods for CVE-2024-12368

Indicators of Compromise

Unexpected export operations against the res.users model from non-administrative accounts.
Access to OAuth-protected third-party services from IP addresses or user agents that do not match the legitimate user's baseline.
OAuth provider logs showing token reuse from anomalous locations shortly after Odoo access by a different internal account.

Detection Strategies

Audit Odoo access logs for RPC calls to read, search_read, or export_data targeting res.users and OAuth-related fields.
Correlate Odoo user activity with downstream OAuth provider sign-in logs to identify token replay from unexpected sources.
Alert on any internal user issuing bulk read operations against user records outside of administrative workflows.

Monitoring Recommendations

Forward Odoo application logs and OAuth identity provider logs to a centralized analytics platform for correlation.
Baseline normal export and API activity per user role and alert on deviations, particularly on the res.users model.
Monitor for OAuth token usage from geolocations or devices inconsistent with the token owner's typical activity.

How to Mitigate CVE-2024-12368

Immediate Actions Required

Upgrade Odoo Community and Enterprise 15.0 to the fixed release provided by Odoo S.A.
Revoke and re-issue OAuth tokens for all users of the affected instance to invalidate any previously exported credentials.
Review recent exports and API activity against res.users to identify any prior exfiltration.

Patch Information

Odoo has addressed the issue in updates to the auth_oauth module for the 15.0 branch. Administrators should apply the vendor-supplied fix and review the GitHub Odoo Issue Discussion for version details and commit references. Instances running unsupported forks should backport the access control fix to the OAuth token field.

Workarounds

Restrict internal user permissions so that only administrators can read or export the res.users model.
Disable the auth_oauth module on instances that do not require OAuth-based authentication until patches are applied.
Shorten OAuth token lifetimes at the identity provider to reduce the value of any exfiltrated tokens.

bash

# Example: restrict export access by removing the group from non-admin users in Odoo
# Navigate to Settings > Users & Companies > Groups and remove
# 'Administration / Access Rights' or similar export-capable groups
# from any account that does not require bulk export capability.