PT-2026-25879 · Typo3 · Extension "E-Mail Mfa Provider"

Jan Holtkötter · Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-4208

Mitre

CVSS v4.0

7.7

7.7

High

Base vector

AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-4208

Affected Products

Extension "E-Mail Mfa Provider"

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-4208 · Security Note
• https://typo3.org/security/advisory/typo3-ext-sa-2026-007 · Note