Security Notice
Hi you@example.com,
As part of our commitment to security and transparency, we are continuing to strengthen FusionAuth through expanded security testing, including the use of advanced AI and frontier models to proactively identify vulnerabilities in our codebase.
These technologies are transforming security research across the industry, enabling researchers to identify weaknesses faster and more comprehensively than ever before. At FusionAuth, we are embracing these advances as part of our ongoing security-hardening efforts, alongside independent security research, and bug bounty programs.
Through these efforts, we have identified and resolved several additional vulnerabilities in FusionAuth version 1.69.4, which is now available. We have no evidence that these vulnerabilities have been exploited and have received no customer reports of exploitation.
Please update to version 1.69.4 as soon as possible. Performing appropriate version updates helps maintain a secure environment.
What You Need to Do
All customers must update to FusionAuth Version 1.69.4 as soon as possible:
Before updating, review the update guide and release notes for any version-specific considerations. If you have questions or need assistance, visit https://account.fusionauth.io/.
Interim Protections
For the majority of FusionAuth Cloud deployments, we have implemented Web Application Firewall (WAF) rules to block known requests associated with these vulnerabilities. Self-hosted deployments are not covered by these protections. Customers with a support plan can contact FusionAuth Support to confirm coverage for their deployment. These protections provide an additional layer of defense but do not replace the need to update.
Version 1.69.4 is required to fully remediate these vulnerabilities.
Security Vulnerabilities Addressed in Version 1.69.4
- Remote Code Execution: A malicious actor could issue a malformed request to execute arbitrary code on the FusionAuth server, potentially exposing sensitive information such as API keys and credentials.
- SAMLv2 Privilege Escalation: Under specific configurations, a malicious actor may be able to gain elevated privileges by intercepting and injecting a modified SAMLv2 response payload. This only affects users with SAMLv2 identity provider configured.
- Unauthenticated Data Exposure: An unauthenticated attacker could access sensitive data, including configuration settings and user details.
- API Authentication Bypass: Improper handling of certain HTTP requests could allow an unauthenticated attacker to execute unauthorized API requests.
Our Continued Commitment to Security
Security is an ongoing commitment and we believe transparency is an essential part of earning and maintaining your trust. As AI continues to advance, it brings powerful new capabilities to security research, allowing us to identify and address potential weaknesses with greater speed and precision.
We see this as an opportunity to make FusionAuth stronger. We will continue investing in advanced testing, proactive vulnerability discovery, AI frontier models, and security hardening while keeping our customers informed and equipped to protect their environments.
If you have any questions or need assistance with your update, our Support team is available through the FusionAuth Account Portal.
Jamey Miller
SVP, Engineering & Technology
You are receiving this email because you have an active account on https://account.fusionauth.io and have been assigned the Security officer role. If you do not wish to continue to receive these product notices, please delete your account, or remove the Security officer role from your user.
|
