p PatchFirst

CVE-2026-40178

CVE-2026-40178 · ajenti.plugin.core has a race conditions in 2FA

This page contains facts from public vulnerability sources. Check the original advisory before updating.

ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication. This vulnerability is fixed in 0.112.

CVSS 6.9 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • ajenti

    Versions
    • < 0.112: Affected

    No fix published

  • ajenti-plugin-core PyPI

    Versions
    • 0.1
    • 0.10
    • 0.100
    • 0.101
    • 0.102
    • 0.103
    • 0.104
    • 0.105
    • 0.106
    • 0.107
    • 0.108
    • 0.109
    • 0.11
    • 0.110
    • 0.111
    • 0.12
    • 0.13
    • 0.14
    • 0.15
    • 0.16
    • 0.17
    • 0.18
    • 0.19
    • 0.2
    • 0.20
    • 0.21
    • 0.22
    • 0.23
    • 0.24
    • 0.25
    • 0.27
    • 0.28
    • 0.3
    • 0.30
    • 0.31
    • 0.32
    • 0.33
    • 0.34
    • 0.35
    • 0.36
    • 0.37
    • 0.38
    • 0.39
    • 0.4
    • 0.40
    • 0.41
    • 0.42
    • 0.43
    • 0.45
    • 0.46
    • 0.47
    • 0.48
    • 0.49
    • 0.5
    • 0.50
    • 0.51
    • 0.52
    • 0.54
    • 0.56
    • 0.57
    • 0.59
    • 0.6
    • 0.60
    • 0.61
    • 0.62
    • 0.63
    • 0.64
    • 0.65
    • 0.66
    • 0.67
    • 0.68
    • 0.69
    • 0.7
    • 0.71
    • 0.72
    • 0.73
    • 0.74
    • 0.75
    • 0.76
    • 0.78
    • 0.79
    • 0.8
    • 0.80
    • 0.81
    • 0.82
    • 0.83
    • 0.84
    • 0.85
    • 0.86
    • 0.87
    • 0.88
    • 0.89
    • 0.9
    • 0.90
    • 0.91
    • 0.92
    • 0.93
    • 0.94
    • 0.95
    • 0.96
    • 0.97
    • 0.98
    • 0.99
    Affected ranges
    • ECOSYSTEM: < 0.112

    Update to 0.112

Original sources

Check your server →