GitHub Advisoryadvisory · PyPI

GHSA-8647-755q-fw9p ajenti.plugin.core has race conditions in 2FA

MEDIUM Published 2026-04-10 Modified 2026-04-24 Official page ↗
Aliases
CVE-2026-40178
Ecosystem
PyPI
Packages
ajenti.plugin.core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-287, CWE-362
Reviewed
2026-04-10

Affected packages

• PyPI ajenti.plugin.core: < 0.112 → fixed in 0.112

Description

Impact If the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication. Patches This is fixed in the version 0.112. Users should upgrade to this version as soon as possible.

Related

Alias · CVE (1)

  • CVE-2026-40178 ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References