Saleor CSRF bypass in refreshToken mutation
Saleor is an e-commerce platform. Starting in version 3.10.0 and prior to versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19, an attacker may bypass cross-set request forgery (CSRF) validation when calling refresh token mutation with empty string. When a user provides an empty string in `refreshToken` mutation, while the token persists in `JWT_REFRESH_TOKEN_COOKIE_NAME` cookie, application omits validation against CSRF token and returns valid access token. Versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19 contain a patch for the issue. As a workaround, one may replace `saleor.graphql.account.mutations.authentication.refresh_token.py.get_refresh_token`. This will fix the issue, but be aware, that it returns `JWT_MISSING_TOKEN` instead of `JWT_INVALID_TOKEN`.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-31205
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 01:09 UTC · Revision 1
Source evidence
Saleor CSRF bypass in refreshToken mutation
core-osv · Original sourcePublished 8 Apr 2024, 14:26 UTC
Saleor is an e-commerce platform. Starting in version 3.10.0 and prior to versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19, an attacker may bypass cross-set request forgery (CSRF) validation when calling refresh token mutation with empty string. When a user provides an empty string in `refreshToken` mutation, while the token persists in `JWT_REFRESH_TOKEN_COOKIE_NAME` cookie, application omits validation against CSRF token and returns valid access token. Versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19 contain a patch for the issue. As a workaround, one may replace `saleor.graphql.account.mutations.authentication.refresh_token.py.get_refresh_token`. This will fix the issue, but be aware, that it returns `JWT_MISSING_TOKEN` instead of `JWT_INVALID_TOKEN`.
osv:CVE-2024-31205
Complete source record
{
"id": "0bafdd9309fb051b2d39cee1f77bfe3c304c8bfe68bfc4d6b7e2a52e75706c06",
"url": "https://osv.dev/vulnerability/CVE-2024-31205",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Saleor CSRF bypass in refreshToken mutation",
"summary": "Saleor is an e-commerce platform. Starting in version 3.10.0 and prior to versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19, an attacker may bypass cross-set request forgery (CSRF) validation when calling refresh token mutation with empty string. When a user provides an empty string in `refreshToken` mutation, while the token persists in `JWT_REFRESH_TOKEN_COOKIE_NAME` cookie, application omits validation against CSRF token and returns valid access token. Versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19 contain a patch for the issue. As a workaround, one may replace `saleor.graphql.account.mutations.authentication.refresh_token.py.get_refresh_token`. This will fix the issue, but be aware, that it returns `JWT_MISSING_TOKEN` instead of `JWT_INVALID_TOKEN`.",
"evidence": "osv:CVE-2024-31205",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2024-31205",
"aliases": [
"CVE-2024-31205",
"GHSA-ff69-fwjf-3c9w"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/saleor/saleor",
"type": "GIT",
"events": [
{
"introduced": "792acfb0fb764a8074f4e7e3e2c28a32d43f81f9"
},
{
"fixed": "96b115f94965c4cee15c8a5c0dbfbe7cc14a44a8"
},
{
"introduced": "e4dfe7c0dbc7a422375094959a05f80d23598404"
},
{
"fixed": "08e1c8b3f4269b42df3c9c00cc27ec694cfe3061"
},
{
"introduced": "c6ea4207e34902497351d96f983089ebe524e20d"
},
{
"fixed": "fe7e513687a5fe760249642449570762ae5572b1"
},
{
"introduced": "ac075637daf1f6eb77d01aa3d576ee4cbe03008e"
},
{
"fixed": "2c459b93fdd44356f38bc0810e2af9dc5f63d0dd"
},
{
"introduced": "bad64d62e7b350a4fd87a36abcb1586d278edecd"
},
{
"fixed": "9c52aba230c9272e7966aad3c00f8bada11ae007"
},
{
"introduced": "a27de16f3f17668f4f007e79c44cd0c496f40eab"
},
{
"fixed": "9b765f30466df63e2f61db5bec5b1fc31ac90cc4"
},
{
"fixed": "36699c6f5c99590d24f46e3d5c5b1a3c2fd072e7"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.10.0"
},
{
"fixed": "3.14.64"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.15.0"
},
{
"fixed": "3.15.39"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.16.0"
},
{
"fixed": "3.16.39"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.17.0"
},
{
"fixed": "3.17.35"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.18.0"
},
{
"fixed": "3.18.31"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.19.0"
},
{
"fixed": "3.19.19"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "36699c6f5c99590d24f46e3d5c5b1a3c2fd072e7"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"3.15.38",
"3.16.38",
"3.17.34",
"3.18.30",
"3.19.18",
"3.16.37",
"3.19.17",
"3.16.36",
"3.17.33",
"3.18.29",
"3.19.16",
"3.16.35",
"3.19.15",
"3.18.28",
"3.17.32",
"3.16.34",
"3.15.37",
"3.15.36",
"3.16.33",
"3.17.31",
"3.18.27",
"3.19.14",
"3.18.26",
"3.17.30",
"3.16.32",
"3.15.35",
"3.19.13",
"3.18.25",
"3.19.12",
"3.19.11",
"3.17.29",
"3.16.31",
"3.15.34",
"3.18.24",
"3.16.30",
"3.19.10",
"3.18.23",
"3.19.9",
"3.18.22",
"3.17.28",
"3.16.29",
"3.15.33",
"3.19.8",
"3.19.7",
"3.18.21",
"3.17.27",
"3.17.26",
"3.16.28",
"3.15.32",
"3.19.6",
"3.18.20",
"3.15.31",
"3.16.27",
"3.17.25",
"3.18.19",
"3.19.5",
"3.16.26",
"3.15.30",
"3.19.4",
"3.18.18",
"3.17.24",
"3.19.3",
"3.19.2",
"3.18.17",
"3.17.23",
"3.16.25",
"3.15.29",
"3.18.16",
"3.15.28",
"3.16.24",
"3.17.22",
"3.19.1",
"3.19.0",
"3.16.23",
"3.17.21",
"3.15.27",
"3.16.22",
"3.15.26",
"3.18.15",
"3.15.25",
"3.18.14",
"3.16.21",
"3.17.20",
"3.16.20",
"3.15.24",
"3.18.13",
"3.17.19",
"3.18.12",
"3.18.11",
"3.17.18",
"3.18.10",
"3.17.17",
"3.16.19",
"3.15.23",
"3.18.9",
"3.17.16",
"3.16.18",
"3.15.22",
"3.17.15",
"3.18.8",
"3.17.14",
"3.16.17",
"3.15.21",
"3.18.7",
"3.17.13",
"3.16.16",
"3.15.20",
"3.18.6",
"3.17.12",
"3.18.5",
"3.17.11",
"3.18.4",
"3.17.10",
"3.16.15",
"3.15.19",
"3.15.18",
"3.16.14",
"3.17.9",
"3.18.3",
"3.17.8",
"3.16.13",
"3.15.17",
"3.18.2",
"3.17.7",
"3.17.6",
"3.16.12",
"3.15.16",
"3.18.1",
"3.18.0",
"3.17.5",
"3.16.11",
"3.15.15",
"3.16.10",
"3.15.14",
"3.17.4",
"3.17.3",
"3.17.2",
"3.17.1",
"3.16.9",
"3.15.13",
"3.15.12",
"3.16.8",
"3.15.11",
"3.17.0",
"3.16.7",
"3.15.10",
"3.16.6",
"3.16.5",
"3.15.9",
"3.16.4",
"3.15.8",
"3.16.3",
"3.16.2",
"3.16.1",
"3.15.7",
"3.16.0",
"3.15.6",
"3.15.5",
"3.15.4",
"3.15.3",
"3.15.2",
"3.15.1",
"3.15.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31205.json"
}
}
],
"modified": "2026-10-28T02:30:48.605608373Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31205.json",
"https://github.com/saleor/saleor/security/advisories/GHSA-ff69-fwjf-3c9w",
"https://nvd.nist.gov/vuln/detail/CVE-2024-31205",
"https://github.com/saleor/saleor/commit/36699c6f5c99590d24f46e3d5c5b1a3c2fd072e7"
],
"provider_metadata": {
"cwe_ids": [
"CWE-352"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31205.json"
}
},
"related_cves": [
{
"value": "CVE-2024-31205",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 516867,
"published_at": "2024-04-08T14:26:30.971+00:00"
}