CVE-2024-1621 is a high severity flaw in the registration process of uniFLOW Online apps from NT-ware. When email login is enabled and the tenant uses Microsoft Safe Links or a similar tool, an attacker could register an app against a real user. NT-ware says the April 2024 release fixed it.
What's affected
The NVD record says versions prior to and including 2024.1.0 are affected when email login is enabled on the tenant. NT-ware's advisory, released on 10 June 2024 and updated on 11 September 2024, lists three apps: uniFLOW SmartClient (Windows and Mac), the uniFLOW Online Print and Scan mobile app for iOS and Android, and the uniFLOW Online Chrome extension.
The vendor says the issue only affects customers who use email login together with Microsoft Safe Links or a similar link analysis tool. It also says that as of the advisory, the issue can no longer be actively exploited because it was addressed in the April 2024 release.
Severity differs between sources. The NVD record scores it 7.5 (high) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. NT-ware's advisory lists CVSS 3.1 base score 8.2 with a different vector (C:H/I:N/A:L), and rates likelihood as very low and impact as high. Both land in the high band. The weakness class is CWE-940 (improper verification of source of a communication channel).
How to check if you're exposed
This is a cloud service, so you cannot check a package version on a host. Start with the tenant settings and the advisory.
- Check whether email login is enabled on your uniFLOW Online tenant.
- Check whether your mail system rewrites or scans links with Safe Links or a similar product.
- Ask NT-ware support, or read the advisory, for the steps to review app registrations.
The vendor notes that it is theoretically possible that users had apps registered against their account by a malicious actor before the fix. So a review of past registrations is worth the effort even though active exploitation is no longer possible.
What to do now
- Confirm the tenant has the April 2024 release or later. The vendor says this release closes the issue.
- If you use email login with link scanning, review the list of registered apps per user and remove any you do not recognize.
- Ask users to re-register devices if you cannot tell which registrations are legitimate.
- Read the NT-ware advisory in full for the recommended actions and any later updates.
- Record the severity mismatch (7.5 versus 8.2) in your ticket so reviewers know both figures.
Why it matters
The flow is simple to describe. Registration relies on a link sent to the user. A link scanner can follow that link before the user does, and that changes who ends up bound to the registration. The result, per the NVD text, is that an attacker may register themselves against a genuine user and gain the same access through the app that the user has.
It is a good reminder that security tools in the mail path can change the behavior of workflows built on one time links. The CVE is not listed as a CISA Known Exploited Vulnerability. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.
Quick check
What should I do if I cannot tell whether devices were registered by attackers?
Review the registered apps for each user and ask users to re-register. The vendor says it is theoretically possible that apps were registered against accounts before the fix.
Sources
Last reviewed: 19 October 2026.
