Skip to content
OpenAdvisories

Package · PyPI

edumfa

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High —
    GHSA-j5rm-v3vh-vx94

    eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges

    ### Impact In eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire ### Patches Fixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges. ### Workarounds No known workarounds besides disabling userle…

    edumfa PyPI
  • High —
    GHSA-qq2p-4282-cfc5

    eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage

    ### Impact For deployments using MySQL or MariaDB < 11.6.2 (or newer with innodb_snapshot_isolation=off) reusage of token values might be possible due to faulty transaction isolation inside the database. Exploiting this requires racing this transaction. Affec…

    edumfa PyPI