CVE-2024-37830: 
NixOS vulnerability analysis and mitigation

CVE-2024-37830 affects Outline version 0.76.1 and earlier versions. The vulnerability was discovered and disclosed in July 2024. This security issue allows attackers to perform an open redirect attack by intercepting and modifying the state cookie during the OAuth flow (NVD).

The vulnerability is classified as an Open Redirect (CWE-601) with a CVSS v3.1 base score of 6.1 (Medium) according to NIST and 4.3 (Medium) according to CISA-ADP. The attack vector is network-based (AV:N) with low attack complexity (AC:L), requires no privileges (PR:N), and needs user interaction (UI:R) (NVD).

If successfully exploited, this vulnerability allows attackers to redirect users to malicious websites by manipulating the state cookie during the authentication process. This could potentially lead to phishing attacks and compromise of user credentials (GitHub Exploit).

A proof of concept (PoC) exploit has been published demonstrating how an attacker can intercept the authentication request and modify the state cookie value to redirect to an arbitrary domain (GitHub Exploit).

Users should upgrade to a version newer than Outline v0.76.1 when available. No specific workarounds have been published at the time of this report (NVD).