PatchTheCVE: authcrunchhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2024-21500: All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Exceshttps://patchthecve.com/cve/CVE-2024-21500.htmlhttps://patchthecve.com/cve/CVE-2024-21500.htmlWed, 17 Jun 2026 07:09:37 +0000MEDIUM 4.8: All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts via the two-factor authentication (2FA). Although the application blocks the user after several failed attempts to provide 2FA codes, attackers can bypass this bCVE-2024-21498: All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (https://patchthecve.com/cve/CVE-2024-21498.htmlhttps://patchthecve.com/cve/CVE-2024-21498.htmlWed, 17 Jun 2026 07:09:37 +0000MEDIUM 5.3: All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (SSRF) via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by exploitiCVE-2024-21496: All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) vihttps://patchthecve.com/cve/CVE-2024-21496.htmlhttps://patchthecve.com/cve/CVE-2024-21496.htmlWed, 17 Jun 2026 07:09:36 +0000MEDIUM 6.1: All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS (e.g., [&], [<], [>], ["], [']), it does notCVE-2024-21492: All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiratihttps://patchthecve.com/cve/CVE-2024-21492.htmlhttps://patchthecve.com/cve/CVE-2024-21492.htmlWed, 17 Jun 2026 07:09:36 +0000MEDIUM 4.8: All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid even after requests are sent to /logout and /oauth2/google/logout. Attackers who CVE-2023-52430: The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XShttps://patchthecve.com/cve/CVE-2023-52430.htmlhttps://patchthecve.com/cve/CVE-2023-52430.htmlWed, 17 Jun 2026 06:42:40 +0000MEDIUM 6.1: The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring.