GHSA-74r7-3mjm-jc5v

Source

https://github.com/advisories/GHSA-74r7-3mjm-jc5v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-74r7-3mjm-jc5v/GHSA-74r7-3mjm-jc5v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-74r7-3mjm-jc5v

Published

2026-05-18T15:35:42Z

Modified

2026-05-18T15:48:51Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check

Details

Impact

If the resolver parameter is passed, but the user does not exist, all failcounters of tokens in that resolver will be increased.

Patches

This, along with other issues, was fixed in eduMFA v2.9.1.

Workarounds

Limiting access to /validate/check to client applications (i.e. Shibboleth/FreeRADIUS) using an authorization policy with api_key_required or using e.g. the reverse proxy.

Database specific

{
    "cwe_ids":  [
        "CWE-20"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-18T15:35:42Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / edumfa

Package

Name: edumfa; View open source insights on deps.dev
Purl: pkg:pypi/edumfa

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.9.1

Affected versions

1.*

1.2.0

1.3.0

1.4.0

1.5.0

1.5.1

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.1.0

2.2.0

2.3.0

2.4.0

2.5.0

2.6.0

2.6.1

2.7.0

2.7.1

2.7.2

2.8.0

2.9.0rc1

2.9.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-74r7-3mjm-jc5v/GHSA-74r7-3mjm-jc5v.json"