CVE-2024-36048

What it actually does

QAbstractOAuth in Qt Network Authorization seeds its PRNG using only the current time, producing predictable random values that can be guessed by an attacker observing request timing.

Why it matters to the business

Applications relying on Qt OAuth may expose authentication tokens or session data to unauthorized access, leading to account compromise, data leaks, or service disruption; the issue affects widely used Qt and Movim deployments with fixes available since mid-2024.

How an attack unfolds

An attacker monitors the approximate time of an OAuth request, replicates the time-based seed locally to generate the same PRNG sequence, and uses the resulting guessable values to forge or predict authorization tokens and bypass authentication.

How to fix it

Upgrade qt/qtbase to commit 8e79bee4afa2a1466f360f44fb07d24e432a82a6 or later and movim/movim to commit 49e2012aecdf918bb1d16f278fa9ff42fad29a9d or later; rebuild and redeploy affected applications after applying the updates.

How to confirm the fix worked

Confirm the installed Qt version meets or exceeds the fixed commits listed above, review build logs for the updated PRNG seeding logic, and test OAuth flows to ensure non-time-only randomness is in use.

Typical attack path

1. Observe network traffic or logs to capture the timestamp of an OAuth authorization request
2. Reproduce the PRNG seed using the observed time value
3. Generate the predictable random sequence offline
4. Use predicted values to forge tokens or replay authorization material
5. Gain unauthorized access to protected resources or accounts

How to detect it

Review application logs for OAuth token generation around request timestamps, look for repeated or sequential authorization values that correlate with system clock times, and inspect source or binary for time-only PRNG seeding patterns in Qt OAuth code paths.

What your security team should do

• Prioritize patching Qt-based applications within standard change windows given the high CVSS and public disclosure
• Audit all OAuth implementations using Qt Network Authorization for exposure
• Monitor upstream Qt and Movim release notes for any additional related fixes
• Consider runtime detection for predictable token patterns in high-risk environments