GitHub Advisoryadvisory · PyPI

GHSA-3mcx-6wxm-qr8v ajenti.plugin.core has password bypass when 2FA is activated

CRITICAL Published 2026-04-10 Modified 2026-04-24 Official page ↗
Aliases
CVE-2026-40177
Ecosystem
PyPI
Packages
ajenti.plugin.core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-287
Reviewed
2026-04-10

Affected packages

• PyPI ajenti.plugin.core: < 0.112 → fixed in 0.112

Description

Impact If the 2FA was activated, it was possible to bypass the password authentication Patches This is fixed in the version 0.112. Users should upgrade to this version as soon as possible.

Related

Alias · CVE (1)

  • CVE-2026-40177 ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References