PT-2026-44437 · Pypi · Edumfa

Publicado 2026-05-18 · Atualizado 2026-05-18

OSV

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Impact

If the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased.

Patches

This, along with other issues, was fixed in eduMFA v2.9.1.

Workarounds

Limiting access to /validate/check to client applications (i.e. Shibboleth/FreeRADIUS) using an authorization policy with api key required or using e.g. the reverse proxy.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

GHSA-74R7-3MJM-JC5V

Produtos afetados

Edumfa

Referências · 3

• https://github.com/eduMFA/eduMFA/security/advisories/GHSA-74r7-3mjm-jc5v · Nota
• https://github.com/eduMFA/eduMFA · Nota
• https://osv.dev/vulnerability/GHSA-74r7-3mjm-jc5v · Aviso do Fabricante