GHSA-74r7-3mjm-jc5v
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
GHSA-74r7-3mjm-jc5v is a medium vulnerability (CVSS 6.5) in edumfa, published May 18, 2026. No source lists public exploit code. Fixed in edumfa 2.9.1.
- Severity
- 6.5 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.9.1edumfa +1 more
Description
Impact
If the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased.
Patches
This, along with other issues, was fixed in eduMFA v2.9.1.
Workarounds
Limiting access to /validate/check to client applications (i.e. Shibboleth/FreeRADIUS) using an authorization policy with api_key_required or using e.g. the reverse proxy.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected packages
What each source reports
GitHub Advisories Score used
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
Impact
If the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased.
Patches
This, along with other issues, was fixed in eduMFA v2.9.1.
Workarounds
Limiting access to /validate/check to client applications (i.e. Shibboleth/FreeRADIUS) using an authorization policy with api_key_required or using e.g. the reverse proxy.
- Record
GHSA-74r7-3mjm-jc5v- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
Impact
If the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased.
Patches
This, along with other issues, was fixed in eduMFA v2.9.1.
Workarounds
Limiting access to /validate/check to client applications (i.e. Shibboleth/FreeRADIUS) using an authorization policy with api_key_required or using e.g. the reverse proxy.
- Record
GHSA-74r7-3mjm-jc5v- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.