CVE-2024-1403 is a critical (CVSS 10.0) authentication bypass in Progress OpenEdge Authentication Gateway and AdminServer. Unexpected content in the username or password can lead to access without valid credentials. Versions before 11.7.19, 12.2.14 and 12.8.1 are affected. Upgrade to those releases or later.
What's affected
Per the NVD record, the vulnerable products are the OpenEdge Authentication Gateway and the AdminServer, on every platform OpenEdge supports. The affected ranges are:
- OpenEdge 11.7 releases before 11.7.19
- OpenEdge 12.2 releases before 12.2.14
- OpenEdge 12.8 releases before 12.8.1
The vendor published a critical alert on its community site, which is the first reference in the record. I could not retrieve that page when writing this guide, so confirm the version ranges and any extra steps there.
How to check if you're exposed
Find your OpenEdge version from the installation. On most systems the proversion utility in the OpenEdge install directory prints it:
proversion -v
Then work out whether the Authentication Gateway or the AdminServer is running and who can reach it on the network. The AdminServer should not be exposed beyond the administrators who need it.
Check the vendor alert for the exact fixed builds in your release line.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Inventory every OpenEdge installation and note its release.
- Upgrade to 11.7.19, 12.2.14, 12.8.1 or a later release in your line.
- Restrict network access to the Authentication Gateway and AdminServer to known management hosts until the upgrade is done.
- Review logs for unexpected successful logins to the AdminServer.
- Read the vendor critical alert and follow any extra steps it lists.
Why it matters
The record classes this as CWE-305, authentication bypass by primary weakness. The authentication code mishandled certain unexpected content inside the credentials, so the check could be satisfied without a valid username and password.
A CVSS 10.0 reflects network reach, low complexity, no privileges, no user interaction and a changed scope. Because the affected components handle administration and authentication for a database platform, a bypass hands control to whoever can reach the port. The record's KEV flag is false and the record does not describe exploitation in the wild.
Quick check
Does the bug need valid credentials?
No. The record describes access without proper authentication.
Which components are affected?
The OpenEdge Authentication Gateway and the AdminServer.
Sources
Last reviewed: 19 October 2026.
