GitHub Advisoryadvisory · PyPI

GHSA-qq2p-4282-cfc5 eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage

HIGH Published 2026-05-18 Modified 2026-05-18 Official page ↗
Ecosystem
PyPI
Packages
edumfa
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L
Weaknesses
CWE-285
Reviewed
2026-05-18

Affected packages

• PyPI edumfa: < 2.9.1 → fixed in 2.9.1

Description

Impact For deployments using MySQL or MariaDB = 11.6.2 the default is ON, which is not affected • Same rules applies for Galera with underlying MariaDB Patches Fixed in version 2.9.1 by locking rows prior to write with SELECT FOR UPDATE. Workarounds Set innodb_snapshot_isolation to ON (default in MariaDB >= 11.6.2, e.g packaged in Debian 13). Resources https://mariadb.com/resources/blog/isolation-level-violation-testing-and-debugging-in-mariadb/

Related

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References