---
id: CVE-2024-45793
aliases:
  - GHSA-rxq8-q85f-m866
  - PYSEC-2026-1269
title: Prevent XSS from Confidant API call
summary: Prevent XSS from Confidant API call
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
vendor: confidant
product: confidant
ecosystem: pip
affected:
  - confidant < 6.6.2
patched:
  - confidant 6.6.2
published: '2024-09-20'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-rxq8-q85f-m866'
references:
  - url: 'https://github.com/lyft/confidant/security/advisories/GHSA-rxq8-q85f-m866'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-45793'
  - url: >-
      https://github.com/lyft/confidant/commit/8876b07abde0c8d2a4974f79b60562b6d0193db9
  - url: 'https://hackerone.com/reports/2332004'
  - url: 'https://hackerone.com/reports/2456673'
  - url: 'https://hackerone.com/reports/2476542'
  - url: 'https://github.com/lyft/confidant'
tags:
  - osv
  - pip
epss: 0.00359
epssPercentile: 0.27137
ingestedAt: '2026-07-08T18:25:53.041Z'
---

## Overview

### Impact
_What kind of vulnerability is it? Who is impacted?_
Potential XSS from API calls below:
GET <app>/v1/credentials
GET <app>/v1/credentials/<id>
GET <app>/v1/archive/credentials/<id>
GET <app>/v1/archive/credentials
POST <app>/v1/credentials
PUT <app>/v1/credentials/<id>
PUT <app>/v1/credentials/<id>/<to_revision>

GET <app>/v1/services
GET <app>/v1/services/<id>
GET <app>/v1/archive/services/<id>
GET <app>/v1/archive/services
PUT <app>/v1/services/<id>
PUT <app>/v1/services/<id>/<to_revision>

Stored XSS that can only be used as a stored HTML injection. The attacker needs to be authenticated and have privileges to create new credentials, but could use this to show information and run scripts to other users into the same Confidant instance.

### Patches
_Has the problem been patched? What versions should users upgrade to?_
yes, version 6.6.2

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
NO

### References
_Are there any links users can visit to find out more?_
https://hackerone.com/reports/2332004
https://hackerone.com/reports/2456673
https://hackerone.com/reports/2476542
Acknowledgement: 
Thank you Rein Daelman ([trein](https://hackerone.com/trein)) for reporting and proposing the fix.

## Affected packages

- `confidant < 6.6.2`

## Remediation

Upgrade to a patched release:

- `confidant 6.6.2`