CVE-2024-39337: Passwordstate Core Authentication Bypass

CVE-2024-39337 Overview

CVE-2024-39337 is an authentication bypass vulnerability in Click Studios Passwordstate Core, an enterprise password management solution. Versions prior to 9.8 build 9858 allow attackers to bypass authentication controls over the network without user interaction. The flaw maps to CWE-290: Authentication Bypass by Spoofing and can expose stored credentials or administrative functions to unauthorized users. Because Passwordstate holds privileged secrets for enterprise environments, any authentication weakness carries downstream risk of credential theft and lateral movement.

Critical Impact
Unauthenticated network attackers can bypass authentication in Passwordstate Core, potentially accessing an enterprise password vault and exposing stored credentials to further compromise.

Affected Products

Click Studios Passwordstate Core versions prior to 9.8 build 9858
Passwordstate deployments exposed to network-reachable clients
On-premises Passwordstate installations that have not applied the vendor-supplied build

Discovery Timeline

2024-06-24 - CVE-2024-39337 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-39337

Vulnerability Analysis

The issue is classified as an authentication bypass in Passwordstate Core. Passwordstate is a self-hosted enterprise password manager, so authentication is the primary control protecting credential records and administrative APIs. A bypass here allows an attacker to interact with functionality that should require valid credentials or session state.

The advisory states that the vulnerability is fixed in build 9858 of version 9.8. Attack complexity is low and no privileges or user interaction are required, which means exploitation attempts can be scripted against reachable Passwordstate endpoints. The impact is scoped to confidentiality and integrity of application data rather than full host compromise, consistent with a logic-level authentication weakness rather than a code execution flaw.

At the time of writing, no public proof-of-concept, exploit module, or CISA Known Exploited Vulnerabilities listing is associated with CVE-2024-39337. The EPSS probability is 0.307%.

Root Cause

The underlying weakness is [CWE-290], authentication bypass by spoofing. Click Studios has not published low-level technical detail, but weaknesses in this class typically involve trust decisions based on client-supplied values, missing verification steps in an authentication handler, or insufficient validation of request context before granting access. The Passwordstate change log and Click Studios advisory pages are the authoritative sources for the specific defect and its remediation.

Attack Vector

Exploitation occurs over the network against a Passwordstate Core instance. An attacker sends crafted requests that cause the application to treat the caller as authenticated without a valid credential or session. Because Passwordstate is typically deployed inside enterprise networks and integrated with browser extensions, API clients, and mobile clients, exposed endpoints on internal networks or via reverse proxies are the primary attack surface.

No verified public exploit code is available. See the Click Studios Security Advisories and Passwordstate Change Log for vendor-authoritative details.

Detection Methods for CVE-2024-39337

Indicators of Compromise

Successful authenticated actions in Passwordstate audit logs that do not correspond to a preceding interactive login event.
Unexpected API calls to Passwordstate endpoints from hosts or IP addresses that are not part of documented client inventory.
New or modified privileged records, password lists, or user role changes without matching administrator activity.
Bulk read operations against password entries within short time windows, indicating scripted access.

Detection Strategies

Compare the running Passwordstate version against build 9.8 9858 and flag any host below this build as vulnerable.
Correlate web server access logs with application audit logs to identify requests that reach authenticated endpoints without matching login events.
Alert on anomalous user-agent strings and source IPs interacting with the Passwordstate API surface.

Monitoring Recommendations

Forward Passwordstate application logs, IIS or reverse-proxy logs, and host telemetry into a centralized SIEM or data lake for correlation.
Baseline normal administrator and service account activity in Passwordstate and alert on deviations such as off-hours access or new client hosts.
Monitor outbound network traffic from the Passwordstate server for signs of credential exfiltration following any suspicious authenticated access.

How to Mitigate CVE-2024-39337

Immediate Actions Required

Upgrade Passwordstate Core to version 9.8 build 9858 or later on all instances, including disaster recovery replicas.
Restrict network access to the Passwordstate web interface and API to trusted management networks and VPN clients only.
Rotate high-value credentials stored in Passwordstate if audit logs cannot definitively rule out unauthorized access prior to patching.
Review Passwordstate user, role, and API key inventory and revoke any accounts that are no longer required.

Patch Information

Click Studios addressed CVE-2024-39337 in Passwordstate 9.8 build 9858. Consult the Passwordstate Change Log for release notes and the Click Studios Security Advisories page for the corresponding security bulletin. Apply the update through the in-product upgrade process or the manual installer supplied by the vendor, following the documented backup and rollback procedure.

Workarounds

Place the Passwordstate web front end behind a reverse proxy or WAF that enforces IP allowlisting and mutual TLS where feasible.
Enforce multi-factor authentication for all Passwordstate accounts and disable legacy authentication methods that are not required.
Temporarily disable exposed API keys and browser extension endpoints until the patched build is deployed.

bash

# Configuration example: verify installed Passwordstate build on Windows host
# Run from an administrative PowerShell session on the Passwordstate server
Get-ItemProperty "HKLM:\SOFTWARE\Clickstudios\Passwordstate" |
  Select-Object BuildNo, Version

# Compare BuildNo against the fixed build
# Fixed in: 9.8 build 9858 or later