CVE-2022-42731
django-mfa2 vulnerable to MFA Replay attack
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.
- Record
CVE-2022-42731- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-294
- Updated
- 2026-11-02
CVE List
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.
- Record
CVE-2022-42731- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-294
- Updated
- 2026-11-02
EUVDEUVD-2022-0080
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.
- Record
EUVD-2022-0080- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vw39-2wj9-4q86
django-mfa2 vulnerable to MFA Replay attack
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.
- Record
GHSA-vw39-2wj9-4q86- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-294
- Updated
- 2026-11-02
OSV
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.
- Record
CVE-2022-42731- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-vw39-2wj9-4q86
django-mfa2 vulnerable to MFA Replay attack
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.
- Record
GHSA-vw39-2wj9-4q86- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-294
- Updated
- 2026-11-02
OSVPYSEC-2022-303 No score
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.
- Record
PYSEC-2022-303- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
django-mfa2PyPI |
before 2.5.1 | 2.5.1 |
django-mfa2PyPI |
2.6.0 up to 2.6.1 | 2.6.1 |
django-mfa2PyPI |
before 2.5.1, plus listed versions 0.80.8.50.8.70.8.80.9.0 Show 45 moreShow less0.9.10.9.20.9.40.9.51.01.0.11.0.21.0.31.0.41.0.51.11.1.11.1.21.1.51.1.61.1.71.1.81.1.8.11.2.01.2.11.3.01.4.01.4.11.5.01.61.7.01.7.101.7.111.7.121.7.131.7.51.7.61.7.71.7.81.7.91.8.01.8.11.9.02.0.02.0.12.0.22.0.32.0.42.0.52.0.6 |
2.5.1 |
django-mfa2PyPI |
before 2.5.1, 2.6.0 up to 2.6.1, plus listed versions 0.80.8.50.8.70.8.80.9.0 Show 45 moreShow less0.9.10.9.20.9.40.9.51.01.0.11.0.21.0.31.0.41.0.51.11.1.11.1.21.1.51.1.61.1.71.1.81.1.8.11.2.01.2.11.3.01.4.01.4.11.5.01.61.7.01.7.101.7.111.7.121.7.131.7.51.7.61.7.71.7.81.7.91.8.01.8.11.9.02.0.02.0.12.0.22.0.32.0.42.0.52.0.6 |
2.5.12.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-42731 is a high vulnerability (CVSS 7.5) in Django-mfa2 Project Django-mfa2, published October 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile. Fixed in django-mfa2 2.5.1.
References
github.com/mkalioby/django-mfa2/blob/0936ea253354dd95cb127f09d0efa31324caef27/mfa/FIDO2.py
nvd.nist.gov/vuln/detail/CVE-2022-42731
Left out here: 22 versions. The JSON record has them.