| タイトル | documenso v2.11.0 Authentication Bypass |
|---|
| 説明 | A vulnerability in Documenso allows two-factor authentication (2FA) bypass through inconsistent authentication enforcement across login methods. When users authenticate using email/password credentials, 2FA verification is enforced as expected. However, when the same account authenticates through Google OAuth, the application grants full authenticated access without requiring the configured second authentication factor.
This vulnerability allows attackers who have obtained access to a victim’s linked Google account credentials, OAuth session, or federated authentication access to bypass the intended multi-factor authentication protection mechanism, resulting in unauthorized account access and reduced account security. The issue stems from authentication policy inconsistency between local and federated authentication flows.
|
|---|
| ソース | ⚠️ https://github.com/documenso/documenso/issues/2758 |
|---|
| ユーザー | Jeetpal2007 (UID 98616) |
|---|
| 送信 | 2026年05月29日 09:37 (4 月 ago) |
|---|
| モデレーション | 2026年06月28日 12:12 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 374551 [Documenso 迄 2.11.0 Google OAuth Login handle-oauth-callback-url.ts 弱い認証] |
|---|
| ポイント | 20 |
|---|