p PatchFirst

CVE-2026-40177

CVE-2026-40177 · Password bypass when 2FA is activated

This page contains facts from public vulnerability sources. Check the original advisory before updating.

ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible to bypass the password authentication This vulnerability is fixed in 0.112.

CVSS 9.3 · Critical · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • ajenti

    Versions
    • < 0.112: Affected

    No fix published

  • ajenti-plugin-core PyPI

    Versions
    • 0.1
    • 0.10
    • 0.100
    • 0.101
    • 0.102
    • 0.103
    • 0.104
    • 0.105
    • 0.106
    • 0.107
    • 0.108
    • 0.109
    • 0.11
    • 0.110
    • 0.111
    • 0.12
    • 0.13
    • 0.14
    • 0.15
    • 0.16
    • 0.17
    • 0.18
    • 0.19
    • 0.2
    • 0.20
    • 0.21
    • 0.22
    • 0.23
    • 0.24
    • 0.25
    • 0.27
    • 0.28
    • 0.3
    • 0.30
    • 0.31
    • 0.32
    • 0.33
    • 0.34
    • 0.35
    • 0.36
    • 0.37
    • 0.38
    • 0.39
    • 0.4
    • 0.40
    • 0.41
    • 0.42
    • 0.43
    • 0.45
    • 0.46
    • 0.47
    • 0.48
    • 0.49
    • 0.5
    • 0.50
    • 0.51
    • 0.52
    • 0.54
    • 0.56
    • 0.57
    • 0.59
    • 0.6
    • 0.60
    • 0.61
    • 0.62
    • 0.63
    • 0.64
    • 0.65
    • 0.66
    • 0.67
    • 0.68
    • 0.69
    • 0.7
    • 0.71
    • 0.72
    • 0.73
    • 0.74
    • 0.75
    • 0.76
    • 0.78
    • 0.79
    • 0.8
    • 0.80
    • 0.81
    • 0.82
    • 0.83
    • 0.84
    • 0.85
    • 0.86
    • 0.87
    • 0.88
    • 0.89
    • 0.9
    • 0.90
    • 0.91
    • 0.92
    • 0.93
    • 0.94
    • 0.95
    • 0.96
    • 0.97
    • 0.98
    • 0.99
    Affected ranges
    • ECOSYSTEM: < 0.112

    Update to 0.112

Original sources

Check your server →