GHSA-9phw-7h96-q3rv
scheb/two-factor-bundle bypass two-factor authentication with remember-me option
In versions prior to 3.26.0 and prior to 4.11.0 of the "scheb/two-factor-bundle" project, a security vulnerability allowed attackers to bypass two-factor authentication (2FA) using the remember_me cookie. When the remember_me checkbox was used during login, a "REMEMBERME" cookie was created. Upon redirection to the 2FA page, attackers could manipulate the SESSIONID key, granting access to the homepage "/" and gaining authentication without completing 2FA.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
What each source reports
GitHub Advisories Score used
scheb/two-factor-bundle bypass two-factor authentication with remember-me option
In versions prior to 3.26.0 and prior to 4.11.0 of the "scheb/two-factor-bundle" project, a security vulnerability allowed attackers to bypass two-factor authentication (2FA) using the remember_me cookie. When the remember_me checkbox was used during login, a "REMEMBERME" cookie was created. Upon redirection to the 2FA page, attackers could manipulate the SESSIONID key, granting access to the homepage "/" and gaining authentication without completing 2FA.
- Record
GHSA-9phw-7h96-q3rv- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
scheb/two-factor-bundle bypass two-factor authentication with remember-me option
In versions prior to 3.26.0 and prior to 4.11.0 of the "scheb/two-factor-bundle" project, a security vulnerability allowed attackers to bypass two-factor authentication (2FA) using the remember_me cookie. When the remember_me checkbox was used during login, a "REMEMBERME" cookie was created. Upon redirection to the 2FA page, attackers could manipulate the SESSIONID key, granting access to the homepage "/" and gaining authentication without completing 2FA.
- Record
GHSA-9phw-7h96-q3rv- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
scheb/two-factor-bundlePackagist | 4.0.0 up to 4.11.0 | 4.11.0 |
scheb/two-factor-bundlePackagist | before 3.26.0 | 3.26.0 |
scheb/two-factor-bundlePackagist | 4.0.0 up to 4.11.0, plus listed versions v4.0.0v4.1.0v4.10.0v4.2.0v4.2.1 Show 9 moreShow lessv4.3.0v4.3.1v4.4.0v4.5.0v4.6.0v4.7.0v4.7.1v4.8.0v4.9.0 | 4.11.0 |
scheb/two-factor-bundlePackagist | before 3.26.0, plus listed versions v0.1.0v0.1.1v0.2.0v0.3.0v1.0.0 Show 45 moreShow lessv1.1.0v1.2.0v1.2.1v1.3.0v1.3.1v1.3.2v1.4.0v1.4.1v1.4.2v1.4.3v1.4.4v1.4.5v1.4.6v1.4.7v1.5.0v1.5.1v2.0.0v2.1.0v2.10.0v2.11.0v2.12.0v2.13.0v2.14.0v2.2.0v2.2.1v2.2.2v2.3.0v2.3.1v2.3.2v2.3.3v2.4.0v2.5.0v2.5.1v2.5.2v2.6.0v2.6.1v2.6.2v2.7.0v2.8.0v2.8.1v2.8.2v2.9.0v3.0.0v3.0.0-beta1v3.0.0-beta2 | 3.26.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-9phw-7h96-q3rv is a high vulnerability (CVSS 7.4) in scheb/two-factor-bundle, published May 21, 2024. No source lists public exploit code. Fixed in scheb/two-factor-bundle 4.11.0.
References
github.com/scheb/two-factor-bundle/issues/253
Left out here: 41 versions. The JSON record has them.