GitHub Advisoryadvisory · PyPI

GHSA-j5rm-v3vh-vx94 eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges

HIGH Published 2026-05-18 Modified 2026-05-18 Official page ↗

Ecosystem: PyPI
Packages: edumfa
Severity: High
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses: CWE-287, CWE-613
Reviewed: 2026-05-18

Affected packages

• PyPI edumfa: < 2.9.1 → fixed in 2.9.1

Description

Impact In eduMFA = 2.9.1 by adding validity information to the userless challenges. Workarounds No known workarounds besides disabling userless login altogether.

Weakness · not in database (1)

CWE-613

Weakness · CWE (1)

CWE-287 Improper Authentication weakness

References