GitHub Advisoryadvisory · PyPI

GHSA-vw39-2wj9-4q86 django-mfa2 vulnerable to MFA Replay attack

HIGH Published 2022-10-11 Modified 2026-06-10 Official page ↗
Aliases
CVE-2022-42731
Ecosystem
PyPI
Packages
django-mfa2
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-294
Reviewed
2022-10-11

Affected packages

• PyPI django-mfa2: < 2.5.1 → fixed in 2.5.1 • PyPI django-mfa2: >= 2.6.0, < 2.6.1 → fixed in 2.6.1

Description

mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.

Related

Alias · CVE (1)

  • CVE-2022-42731 mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a… vulnerability

Weakness · CWE (1)

  • CWE-294 Authentication Bypass by Capture-replay weakness

References