CVE-2026-4208
CVE-2026-4208 · Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.
CVSS 7.7 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
extension "e-mail mfa provider"
- Versions
- ≥ 0, ≤ 1.0.5: Affected (semver)
- 2.0.0: Affected (semver)
No fix published
ralffreit/mfa-email Packagist
- Versions
- 1.0.0
- 1.0.1
- 1.0.2
- 1.0.3
- 1.0.4
- 1.0.5
- Affected ranges
- ECOSYSTEM: < 1.0.7
Update to 1.0.7
ralffreit/mfa-email Packagist
- Versions
- 2.0.0
- Affected ranges
- ECOSYSTEM: ≥ 2.0.0, < 2.0.1
Update to 2.0.1