CVE-2026-121531 in Umami
Summary
by MITRE • 11/04/2026
A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The identified vulnerability resides within Umami, an open-source web analytics platform, specifically affecting versions 3.3.x through 3.4.1. This security flaw is located in the two-factor authentication policy handler component, which governs how multi-factor authentication requirements are enforced during user login attempts. The core technical issue involves a logic error or misconfiguration within the file src/app/api/auth/login/route.ts that allows an attacker to bypass the mandatory second factor of authentication. Instead of enforcing the configured security policy requiring both password and a time-based one-time code, the system erroneously accepts credentials validated by single-factor authentication alone. This represents a critical failure in access control mechanisms where the enforcement layer fails to validate the presence or correctness of the secondary credential before granting session tokens.
From an operational perspective, this vulnerability significantly degrades the security posture for any organization relying on Umami for tracking web traffic while expecting robust account protection via two-factor authentication. By exploiting this flaw, a remote attacker can authenticate as a legitimate user without possessing the second factor device or code. This effectively nullifies the protective benefits of 2FA, exposing user accounts to credential stuffing attacks, brute force attempts, and unauthorized access if passwords are compromised through other vectors such as phishing or data breaches. The ability to initiate this attack remotely means that no physical proximity or prior network access is required, increasing the risk surface considerably for any instance exposed to the internet.
This vulnerability aligns with CWE-287, which describes Improper Authentication, and more specifically relates to weaknesses in multi-factor authentication implementation where one factor can be bypassed entirely. In terms of offensive security frameworks, this behavior corresponds to MITRE ATT&CK technique T1078, Valid Accounts, as it allows an adversary to establish legitimate access using stolen or guessed credentials without the additional hurdle of a second factor. The fact that the exploit has been publicly disclosed and is known to be functional increases the urgency for remediation, as automated scanning tools and malicious actors can readily leverage this knowledge to target vulnerable instances.
The vendor's lack of response following early notification further exacerbates the risk profile, leaving administrators without official patches or guidance from the primary source. Consequently, mitigation strategies must rely on immediate administrative actions rather than waiting for a software update. The most effective remediation is to upgrade Umami to version 3.4.2 or later where this logic error has been corrected. If upgrading is not immediately feasible due to operational constraints, administrators should consider implementing network-level controls such as IP whitelisting for the analytics interface if it contains sensitive data, or deploying a Web Application Firewall with rules specifically designed to detect and block anomalous login patterns associated with 2FA bypass attempts. Additionally, enforcing strong password policies and monitoring authentication logs for successful logins that lack corresponding second-factor validation events can help in detecting potential exploitation of this flaw until the software is patched.