Skip to content
Fencer Intel
high —

GHSA-jhmr-57cj-q6g9 json

Komari vulnerable to 2FA Authentication Bypass

published last yr. modified 8mo ago also GO-2025-3873

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Summary

Logic error in 2FA verification condition allows bypass of two-factor authentication

### Details

https://github.com/komari-monitor/komari/blob/bd5a6934e1b79a12cf1e6a9bba5372d0e04f3abc/api/login.go#L55

There is no way for `Verify2Fa` to return an error **AND** true as `ok` at the same time, any codes are considered as valid.

### PoC

Use any 6 digits as 2FA code

### Impact

Bypass 2FA Authentication

Patch / fix

  • go github.com/komari-monitor/komari 0.0.0-20250809064056-cc3d54bff4c6

Is GHSA-jhmr-57cj-q6g9 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
go github.com/komari-monitor/komari
<0.0.0-20250809064056-cc3d54bff4c6
0.0.0-20250809064056-cc3d54bff4c6

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.