PT-2026-32032 · Ajenti · Ajenti-Plugin-Core

CVE-2026-40178 · Published 2026-04-10 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions ajenti.plugin.core versions prior to 0.112

Description Prior to version 0.112, a timing issue allowed bypassing two-factor authentication (2FA) immediately after a user's successful authentication. This occurred during a brief window after authentication but before the 2FA mechanism was fully engaged.

Recommendations Upgrade to version 0.112.

Fix

Race Condition

Improper Authentication

Weakness Enumeration

CWE-362

CWE-287

Related Identifiers

CVE-2026-40178

GHSA-8647-755Q-FW9P

PYSEC-2026-2340

Affected Products

Ajenti-Plugin-Core

References · 8

• https://github.com/ajenti/ajenti/security/advisories/GHSA-8647-755q-fw9p · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8647-755q-fw9p · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2340 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40178 · Security Note
• https://github.com/ajenti/ajenti · Note
• https://twitter.com/CVEnew/status/2042710181008568337 · Twitter Post
• https://pypi.org/project/ajenti-plugin-core · Note
• https://github.com/advisories/GHSA-8647-755q-fw9p · Note