Description
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django-mfa2 | < 2.5.1 | 2.5.1 | GHSA-vw39-2wj9-4q86 |
| PyPI | django-mfa2 | >= 2.6.0, < 2.6.1 | 2.6.1 | GHSA-vw39-2wj9-4q86 |
| PyPI | django-mfa2 | < 2.5.1 · >= 2.6.0, < 2.6.1 | 2.5.1, 2.6.1 | PYSEC-2022-303 |