Fullstep vulnerabilities
We track 2 vulnerabilities in Fullstep products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on April 22, 2026.
2vulnerabilities
0critical
2high
0exploited
8.1average CVSS score
Latest Fullstep vulnerabilities
- 7.6 High severity
Fullstep: Authorization Bypass Through User-Controlled Key
An insecure direct object reference (IDOR) vulnerability in the Fullstep V5 registration process allows authenticated users to access data belonging to other registered users through various vulnerable authenticated resources in the application. The vulnerable
- 8.7 High severity
Fullstep: Missing Authentication for Critical Functionality
Inadequate access control in the registration process in Fullstep V5, which could allow unauthenticated users to obtain a valid JWT token with which to interact with authenticated API resources. Successful exploitation of this vulnerability could allow an unau