PT-2026-44437 · Pypi · Edumfa

Published 2026-05-18 · Updated 2026-05-18

OSV

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Impact

If the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased.

Patches

This, along with other issues, was fixed in eduMFA v2.9.1.

Workarounds

Limiting access to /validate/check to client applications (i.e. Shibboleth/FreeRADIUS) using an authorization policy with api key required or using e.g. the reverse proxy.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

GHSA-74R7-3MJM-JC5V

Affected Products

Edumfa

References · 3

• https://osv.dev/vulnerability/GHSA-74r7-3mjm-jc5v · Vendor Advisory
• https://github.com/eduMFA/eduMFA/security/advisories/GHSA-74r7-3mjm-jc5v · Note
• https://github.com/eduMFA/eduMFA · Note