Skip to content
Fencer Intel
high —

GHSA-j5rm-v3vh-vx94 json

eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges

published 5mo ago modified 5mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact In eduMFA < 2.9.1 userless Passkey/WebAuthn challenges might be replayed and do not expire

### Patches Fixed in eduMFA >= 2.9.1 by adding validity information to the userless challenges.

### Workarounds No known workarounds besides disabling userless login altogether.

Patch / fix

  • pypi edumfa 2.9.1

Is GHSA-j5rm-v3vh-vx94 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
pypi edumfa
<2.9.1
2.9.1

Classification

Weakness
  • CWE-287 Improper Authentication
  • CWE-613 DEPRECATED: Insufficient Session Expiration

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.