GitHub Advisoryadvisory · PyPI

GHSA-74r7-3mjm-jc5v eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check

MEDIUM Published 2026-05-18 Modified 2026-05-18 Official page ↗
Ecosystem
PyPI
Packages
edumfa
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20
Reviewed
2026-05-18

Affected packages

• PyPI edumfa: < 2.9.1 → fixed in 2.9.1

Description

Impact If the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased. Patches This, along with other issues, was fixed in eduMFA v2.9.1. Workarounds Limiting access to `/validate/check` to client applications (i.e. Shibboleth/FreeRADIUS) using an authorization policy with `api_key_required` or using e.g. the reverse proxy.

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References