GitHub Advisoryadvisory · Go

GHSA-jhmr-57cj-q6g9 Komari vulnerable to 2FA Authentication Bypass

HIGH Published 2025-08-12 Modified 2025-08-12 Official page ↗
Ecosystem
Go
Packages
github.com/komari-monitor/komari
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-287
Reviewed
2025-08-12

Affected packages

• Go github.com/komari-monitor/komari: < 0.0.0-20250809064056-cc3d54bff4c6 → fixed in 0.0.0-20250809064056-cc3d54bff4c6

Description

Summary Logic error in 2FA verification condition allows bypass of two-factor authentication Details https://github.com/komari-monitor/komari/blob/bd5a6934e1b79a12cf1e6a9bba5372d0e04f3abc/api/login.go#L55 There is no way for `Verify2Fa` to return an error AND true as `ok` at the same time, any codes are considered as valid. PoC Use any 6 digits as 2FA code Impact Bypass 2FA Authentication

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References