Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2026-4208

Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TYPO3

Description

The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TYPO3 Extension "E-Mail MFA Provider"

Default version status: unaffected

  • 0 to ≤ 1.0.5affected
  • 2.0.0affected

References