GHSA-h6mp-mc7g-mg49
scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token
Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
What each source reports
GitHub Advisories Score used
scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token
Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication.
- Record
GHSA-h6mp-mc7g-mg49- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token
Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication.
- Record
GHSA-h6mp-mc7g-mg49- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
scheb/two-factor-bundlePackagist | 3.0.0 up to 3.7.0 | 3.7.0 |
scheb/two-factor-bundlePackagist | 3.0.0 up to 3.7.0, plus listed versions v3.0.0v3.1.0v3.2.0v3.3.0v3.3.1 Show 7 moreShow lessv3.4.0v3.5.0v3.5.1v3.6.0v3.6.1v3.6.2v3.6.3 | 3.7.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-h6mp-mc7g-mg49 is a high vulnerability (CVSS 7.4) in scheb/two-factor-bundle, published May 21, 2024. No source lists public exploit code. Fixed in scheb/two-factor-bundle 3.7.0.