{"id":"CVE-2026-28510","aliases":["EUVD-2026-27311","GHSA-x5wv-c9q4-fj65"],"status":"published","title":"elabftw allows MFA bypass during login","description":"eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication state across authentication steps. Under certain conditions, an attacker with valid primary credentials could complete authentication with an attacker-controlled TOTP secret and bypass the additional factor. This could result in unauthorized account access. This issue is fixed in version 5.4.2.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00254,"percentile":0.17096,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-302"],"published":"2026-05-05T12:28:10Z","modified":"2026-10-28T02:31:03Z","products":[{"vendor":"elabftw","product":"elabftw"}],"references":[{"url":"https://github.com/elabftw/elabftw/security/advisories/GHSA-x5wv-c9q4-fj65","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory"]},{"url":"https://github.com/elabftw/elabftw/commit/8b7a575aef128870861187eaa2b2f0f08654ecf9","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28510.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28510","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-28510","title":"elabftw allows MFA bypass during login","description":"eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication state across authentication steps. Under certain conditions, an attacker with valid primary credentials could complete authentication with an attacker-controlled TOTP secret and bypass the additional factor. This could result in unauthorized account access. This issue is fixed in version 5.4.2.","status":"published","published":"2026-05-05T12:28:10.38Z","modified":"2026-05-06T14:14:19.244Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-302"],"updated_at":"2026-11-02T14:20:01.969981Z"}],"euvd":[{"id":"EUVD-2026-27311","description":"eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication state across authentication steps. Under certain conditions, an attacker with valid primary credentials could complete authentication with an attacker-controlled TOTP secret and bypass the additional factor. This could result in unauthorized account access. This issue is fixed in version 5.4.2.","status":"published","published":"2026-05-05T12:28:10Z","modified":"2026-05-06T14:14:19Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T19:05:16.683147Z"}],"nvd":[{"id":"CVE-2026-28510","description":"eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication state across authentication steps. Under certain conditions, an attacker with valid primary credentials could complete authentication with an attacker-controlled TOTP secret and bypass the additional factor. This could result in unauthorized account access. This issue is fixed in version 5.4.2.","status":"published","published":"2026-05-05T13:16:28.667Z","modified":"2026-06-17T10:28:46.203Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-302"],"updated_at":"2026-11-02T14:12:17.022502Z"}],"osv":[{"id":"CVE-2026-28510","title":"elabftw allows MFA bypass during login","description":"eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication state across authentication steps. Under certain conditions, an attacker with valid primary credentials could complete authentication with an attacker-controlled TOTP secret and bypass the additional factor. This could result in unauthorized account access. This issue is fixed in version 5.4.2.","status":"published","published":"2026-05-05T12:28:10.38Z","modified":"2026-10-28T02:31:03.87658785Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-302"],"updated_at":"2026-11-02T15:45:00.530889Z"}]}}