p PatchFirst

PatchFirst · Latest vulnerabilities

scheb/two-factor-bundle vulnerabilities

Vulnerabilities published for scheb/two-factor-bundle in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. GHSA-9phw-7h96-q3rv

    High · CVSS 7.4Fix available

    scheb/two-factor-bundle bypass two-factor authentication with remember-me option

    In versions prior to 3.26.0 and prior to 4.11.0 of the "scheb/two-factor-bundle" project, a security vulnerability allowed attackers to bypass two-factor authentication (2FA) using the remember_me cookie. When the remember_me checkbox was used during login, a "REMEMBERME" cookie was created. Upon redirection to the 2FA page, attackers could manipulate the SESSIONID key, granting access to the homepage "/" and gaining authentication without completing 2FA.

    scheb/two-factor-bundle scheb/two-factor-bundlePHP
    • Update to 3.26.0
    • Update to 4.11.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. GHSA-h6mp-mc7g-mg49

    High · CVSS 7.4Fix available

    scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token

    Before version 3.7 the bundle is vulnerable to a [security issue in JWT](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/), which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication.

    scheb/two-factor-bundlePHP
    • Update to 3.7.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →