CVE-2026-110097 in Ikaros
Summary
by MITRE • 10/13/2026
Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to gain full account access, including the master administrator.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Ikaros versions 1.2.0 through 1.2.5 represents a critical authentication bypass flaw that undermines the integrity of multi-factor authentication mechanisms. Specifically, this issue affects the Time-based One-Time Password (TOTP) verification process, which is designed to provide an additional layer of security beyond standard password authentication. The core technical deficiency lies in how the application handles temporary tokens generated during the initial login phase. When a user successfully authenticates with their primary credentials, such as a username and password, the system generates a temporary token intended for subsequent TOTP verification steps. However, due to improper validation logic, an attacker who possesses valid static credentials can bypass the mandatory second factor by reusing this temporary token in unintended contexts or through alternative authentication pathways.
From a technical perspective, the exploitation vector involves manipulating how the application processes and validates these transient identifiers. An attacker can take the temp token obtained from the jwt/apply endpoint and present it as a standard bearer JWT to access protected resources directly. Alternatively, they may attempt to refresh this token using mechanisms intended for long-lived sessions or exploit HTTP Basic authentication endpoints that fail to enforce the completion of the two-factor verification sequence. This failure indicates that the application does not strictly bind the temporary session state to the requirement of completing TOTP validation before promoting it to a full access token. Consequently, the security boundary between initial credential verification and final authorization is effectively neutralized for any user account where valid passwords are known or compromised.
The operational impact of this vulnerability is severe, particularly given its potential scope across different privilege levels within the Ikaros platform. Since the flaw allows attackers to skip TOTP checks entirely, it renders multi-factor authentication ineffective against credential stuffing attacks or phishing campaigns that result in password leakage. More critically, the vulnerability extends to master administrator accounts. If an attacker obtains valid credentials for a high-privilege account, they can bypass all additional security controls and gain unrestricted administrative access. This level of compromise allows for complete control over the system, including the ability to modify configurations, exfiltrate sensitive data, create backdoor accounts, or disrupt service availability without detection by standard monitoring tools that rely on successful MFA logs as an indicator of legitimate activity.
This flaw aligns with CWE-287, which describes Improper Authentication, specifically relating to the failure to enforce multi-factor authentication requirements during session establishment and token validation. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1078, Valid Accounts, where adversaries leverage legitimate credentials to bypass security controls. The specific method of reusing tokens or exploiting alternative login endpoints also reflects aspects of credential manipulation often seen in attacks targeting OAuth2 or JWT-based authentication flows where state management is not strictly enforced across different endpoint contexts.
To mitigate this vulnerability, immediate patching to version 1.2.6 or later is required as it addresses the underlying logic errors in token handling and session validation. In environments where upgrading is not immediately feasible, network-level controls should be implemented to restrict access to authentication endpoints based on IP reputation if possible, although this is less effective against compromised credentials from trusted networks. Security teams should also audit logs for unusual patterns of token usage, such as the reuse of temporary tokens across different endpoint types or rapid succession of login attempts that do not result in TOTP verification events. Additionally, enforcing strict session binding and ensuring that all authentication endpoints uniformly require completion of multi-factor steps before issuing full access tokens is essential to prevent similar bypasses in other parts of the application architecture.