{"id":"GHSA-29r8-gvx4-r9w3","aliases":["CVE-2026-4208"],"title":"Authentication Bypass in extension \"E-Mail MFA Provider\" (mfa_email)","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.","severity":"high","score":8.8,"published":"2026-03-17T09:31:28.000Z","modified":"2026-05-05T15:55:58.462Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"ralffreit/mfa-email","sources":[{"name":"OSV · GHSA-29r8-gvx4-r9w3","url":"https://osv.dev/vulnerability/GHSA-29r8-gvx4-r9w3"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.0.7"}],"type":"ECOSYSTEM"}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5"],"fixed":["1.0.7"]},{"ecosystem":"Packagist","name":"ralffreit/mfa-email","sources":[{"name":"OSV · GHSA-29r8-gvx4-r9w3","url":"https://osv.dev/vulnerability/GHSA-29r8-gvx4-r9w3"}],"ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.0.1"}],"type":"ECOSYSTEM"}],"versions":["2.0.0"],"fixed":["2.0.1"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-4208","https://github.com/MrSilaz/mfa_email/commit/0bb7e85b236a5232f7b092915453dd7c3da48f12","https://github.com/MrSilaz/mfa_email","https://github.com/MrSilaz/mfa_email/releases/tag/v1.0.7","https://github.com/MrSilaz/mfa_email/releases/tag/v2.0.1","https://typo3.org/security/advisory/typo3-ext-sa-2026-007"],"sources":[{"name":"OSV","id":"GHSA-29r8-gvx4-r9w3","modified":"2026-05-05T15:55:58.462567Z","url":"https://osv.dev/vulnerability/GHSA-29r8-gvx4-r9w3"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.7}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T00:35:31.531Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}