edumfa
Up-to-date multifactor authentication for academic institutions.
View on Github
Activity
- Latest release
- 3w ago
- Total releases
- 26
- Cadence
- ~15 days
- Last 12 months
- 6
Reach
- Stars
- 69
Details
- License
- unknown
- First release
- Mar 01, 2024
| Version | Released | |
|---|---|---|
2.9.5
patch
| ||
2.9.3
patch
| ||
2.9.2
patch
| ||
2.9.1
patch
| ||
2.9.0
minor
3 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev | ||
2.9.0rc1
pre
3 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev | ||
2.8.0
minor
3 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev | ||
2.7.2
patch
3 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev | ||
2.7.1
patch
3 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev | ||
2.7.0
minor
3 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev | ||
2.6.1
patch
3 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev | ||
2.6.0
minor
3 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev | ||
2.5.0
minor
3 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev | ||
2.4.0
minor
3 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev | ||
2.3.0
minor
3 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev | ||
2.2.0
minor
3 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev | ||
2.1.0
minor
4 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-vhmj-5q9r-mm9g
Jul 17, 2024
BlastRADIUS also affects eduMFA
Medium
Network
High
None
SummaryBlastRADIUS (see blastradius.fail for details) also affects eduMFA prior version 2.2.0, because the Message-Authenticator attributes were not checked. DetailsWebsite with the vulnerability information blastradius.fail The original vulnerability has been assigned CVE-2024-3596 Case in vince: https://kb.cert.org/vuls/id/456537 PoCThere is no known proof-of-concept except for the attack shown in the paper from the researchers ImpactAn attacker can trigger an authentication flow with a RADIUS-backed token, intercept the RADIUS packet sent by eduMFA and modify the RADIUS server's answer, which would lead eduMFA to believe that the token is valid, even though the RADIUS servers answer was a reject. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
Fixed in
2.2.0
References Updated Dec 06, 2024 · Source: OSV.dev | ||
2.0.3
patch
4 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-vhmj-5q9r-mm9g
Jul 17, 2024
BlastRADIUS also affects eduMFA
Medium
Network
High
None
SummaryBlastRADIUS (see blastradius.fail for details) also affects eduMFA prior version 2.2.0, because the Message-Authenticator attributes were not checked. DetailsWebsite with the vulnerability information blastradius.fail The original vulnerability has been assigned CVE-2024-3596 Case in vince: https://kb.cert.org/vuls/id/456537 PoCThere is no known proof-of-concept except for the attack shown in the paper from the researchers ImpactAn attacker can trigger an authentication flow with a RADIUS-backed token, intercept the RADIUS packet sent by eduMFA and modify the RADIUS server's answer, which would lead eduMFA to believe that the token is valid, even though the RADIUS servers answer was a reject. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
Fixed in
2.2.0
References Updated Dec 06, 2024 · Source: OSV.dev | ||
2.0.2
patch
4 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-vhmj-5q9r-mm9g
Jul 17, 2024
BlastRADIUS also affects eduMFA
Medium
Network
High
None
SummaryBlastRADIUS (see blastradius.fail for details) also affects eduMFA prior version 2.2.0, because the Message-Authenticator attributes were not checked. DetailsWebsite with the vulnerability information blastradius.fail The original vulnerability has been assigned CVE-2024-3596 Case in vince: https://kb.cert.org/vuls/id/456537 PoCThere is no known proof-of-concept except for the attack shown in the paper from the researchers ImpactAn attacker can trigger an authentication flow with a RADIUS-backed token, intercept the RADIUS packet sent by eduMFA and modify the RADIUS server's answer, which would lead eduMFA to believe that the token is valid, even though the RADIUS servers answer was a reject. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
Fixed in
2.2.0
References Updated Dec 06, 2024 · Source: OSV.dev | ||
2.0.1
patch
4 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-vhmj-5q9r-mm9g
Jul 17, 2024
BlastRADIUS also affects eduMFA
Medium
Network
High
None
SummaryBlastRADIUS (see blastradius.fail for details) also affects eduMFA prior version 2.2.0, because the Message-Authenticator attributes were not checked. DetailsWebsite with the vulnerability information blastradius.fail The original vulnerability has been assigned CVE-2024-3596 Case in vince: https://kb.cert.org/vuls/id/456537 PoCThere is no known proof-of-concept except for the attack shown in the paper from the researchers ImpactAn attacker can trigger an authentication flow with a RADIUS-backed token, intercept the RADIUS packet sent by eduMFA and modify the RADIUS server's answer, which would lead eduMFA to believe that the token is valid, even though the RADIUS servers answer was a reject. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
Fixed in
2.2.0
References Updated Dec 06, 2024 · Source: OSV.dev | ||
2.0.0
major
4 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-vhmj-5q9r-mm9g
Jul 17, 2024
BlastRADIUS also affects eduMFA
Medium
Network
High
None
SummaryBlastRADIUS (see blastradius.fail for details) also affects eduMFA prior version 2.2.0, because the Message-Authenticator attributes were not checked. DetailsWebsite with the vulnerability information blastradius.fail The original vulnerability has been assigned CVE-2024-3596 Case in vince: https://kb.cert.org/vuls/id/456537 PoCThere is no known proof-of-concept except for the attack shown in the paper from the researchers ImpactAn attacker can trigger an authentication flow with a RADIUS-backed token, intercept the RADIUS packet sent by eduMFA and modify the RADIUS server's answer, which would lead eduMFA to believe that the token is valid, even though the RADIUS servers answer was a reject. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
Fixed in
2.2.0
References Updated Dec 06, 2024 · Source: OSV.dev | ||
1.5.1
patch
4 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-vhmj-5q9r-mm9g
Jul 17, 2024
BlastRADIUS also affects eduMFA
Medium
Network
High
None
SummaryBlastRADIUS (see blastradius.fail for details) also affects eduMFA prior version 2.2.0, because the Message-Authenticator attributes were not checked. DetailsWebsite with the vulnerability information blastradius.fail The original vulnerability has been assigned CVE-2024-3596 Case in vince: https://kb.cert.org/vuls/id/456537 PoCThere is no known proof-of-concept except for the attack shown in the paper from the researchers ImpactAn attacker can trigger an authentication flow with a RADIUS-backed token, intercept the RADIUS packet sent by eduMFA and modify the RADIUS server's answer, which would lead eduMFA to believe that the token is valid, even though the RADIUS servers answer was a reject. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
Fixed in
2.2.0
References Updated Dec 06, 2024 · Source: OSV.dev | ||
1.5.0
minor
4 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-vhmj-5q9r-mm9g
Jul 17, 2024
BlastRADIUS also affects eduMFA
Medium
Network
High
None
SummaryBlastRADIUS (see blastradius.fail for details) also affects eduMFA prior version 2.2.0, because the Message-Authenticator attributes were not checked. DetailsWebsite with the vulnerability information blastradius.fail The original vulnerability has been assigned CVE-2024-3596 Case in vince: https://kb.cert.org/vuls/id/456537 PoCThere is no known proof-of-concept except for the attack shown in the paper from the researchers ImpactAn attacker can trigger an authentication flow with a RADIUS-backed token, intercept the RADIUS packet sent by eduMFA and modify the RADIUS server's answer, which would lead eduMFA to believe that the token is valid, even though the RADIUS servers answer was a reject. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
Fixed in
2.2.0
References Updated Dec 06, 2024 · Source: OSV.dev | ||
1.4.0
minor
4 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-vhmj-5q9r-mm9g
Jul 17, 2024
BlastRADIUS also affects eduMFA
Medium
Network
High
None
SummaryBlastRADIUS (see blastradius.fail for details) also affects eduMFA prior version 2.2.0, because the Message-Authenticator attributes were not checked. DetailsWebsite with the vulnerability information blastradius.fail The original vulnerability has been assigned CVE-2024-3596 Case in vince: https://kb.cert.org/vuls/id/456537 PoCThere is no known proof-of-concept except for the attack shown in the paper from the researchers ImpactAn attacker can trigger an authentication flow with a RADIUS-backed token, intercept the RADIUS packet sent by eduMFA and modify the RADIUS server's answer, which would lead eduMFA to believe that the token is valid, even though the RADIUS servers answer was a reject. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
Fixed in
2.2.0
References Updated Dec 06, 2024 · Source: OSV.dev | ||
1.3.0
minor
4 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-vhmj-5q9r-mm9g
Jul 17, 2024
BlastRADIUS also affects eduMFA
Medium
Network
High
None
SummaryBlastRADIUS (see blastradius.fail for details) also affects eduMFA prior version 2.2.0, because the Message-Authenticator attributes were not checked. DetailsWebsite with the vulnerability information blastradius.fail The original vulnerability has been assigned CVE-2024-3596 Case in vince: https://kb.cert.org/vuls/id/456537 PoCThere is no known proof-of-concept except for the attack shown in the paper from the researchers ImpactAn attacker can trigger an authentication flow with a RADIUS-backed token, intercept the RADIUS packet sent by eduMFA and modify the RADIUS server's answer, which would lead eduMFA to believe that the token is valid, even though the RADIUS servers answer was a reject. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
Fixed in
2.2.0
References Updated Dec 06, 2024 · Source: OSV.dev | ||
1.2.0
initial
4 CVEs
GHSA-j5rm-v3vh-vx94
May 18, 2026
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
High
Network
Low
None
None
ImpactIn eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire PatchesFixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. WorkaroundsNo known workarounds besides disabling userless login altogether. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-qq2p-4282-cfc5
May 18, 2026
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
High
Network
High
Low
ImpactFor deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affected are all tokentypes whose values are only supposed to be used once, for example TOTP, HOTP and likely also WebAuthN. Affected Combinations:
PatchesFixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. WorkaroundsSet innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resourceshttps://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/ Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-74r7-3mjm-jc5v
May 18, 2026
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
ImpactIf the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. PatchesThis, along with other issues, was fixed in eduMFA v2.9.1. WorkaroundsLimiting access to Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
+ 10 more Show less
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0
2.9.0rc1
Fixed in
2.9.1
References Updated May 18, 2026 · Source: OSV.dev
GHSA-vhmj-5q9r-mm9g
Jul 17, 2024
BlastRADIUS also affects eduMFA
Medium
Network
High
None
SummaryBlastRADIUS (see blastradius.fail for details) also affects eduMFA prior version 2.2.0, because the Message-Authenticator attributes were not checked. DetailsWebsite with the vulnerability information blastradius.fail The original vulnerability has been assigned CVE-2024-3596 Case in vince: https://kb.cert.org/vuls/id/456537 PoCThere is no known proof-of-concept except for the attack shown in the paper from the researchers ImpactAn attacker can trigger an authentication flow with a RADIUS-backed token, intercept the RADIUS packet sent by eduMFA and modify the RADIUS server's answer, which would lead eduMFA to believe that the token is valid, even though the RADIUS servers answer was a reject. Affected versions
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
Fixed in
2.2.0
References Updated Dec 06, 2024 · Source: OSV.dev |