~ / search / GHSA-29r8-gvx4-r9w3

GHSA-29r8-gvx4-r9w3

Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)

Source: GitHub Advisory Database (reviewed) High CVE-2026-4208

Packages

EcosystemPackageAffectedFixed in
Packagist ralffreit/mfa-email < 1.0.7 1.0.7
Packagist ralffreit/mfa-email >= 2.0.0, < 2.0.1 2.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.

References

External links from the advisory. They lead to third-party sites.