| Título | documenso v2.11.0 Authentication Bypass |
|---|
| Descrição | A vulnerability in Documenso allows two-factor authentication (2FA) bypass through inconsistent authentication enforcement across login methods. When users authenticate using email/password credentials, 2FA verification is enforced as expected. However, when the same account authenticates through Google OAuth, the application grants full authenticated access without requiring the configured second authentication factor.
This vulnerability allows attackers who have obtained access to a victim’s linked Google account credentials, OAuth session, or federated authentication access to bypass the intended multi-factor authentication protection mechanism, resulting in unauthorized account access and reduced account security. The issue stems from authentication policy inconsistency between local and federated authentication flows.
|
|---|
| Fonte | ⚠️ https://github.com/documenso/documenso/issues/2758 |
|---|
| Utilizador | Jeetpal2007 (UID 98616) |
|---|
| Submissão | 29/05/2026 09h37 (há 4 meses) |
|---|
| Moderação | 28/06/2026 12h12 (1 month later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 374551 [Documenso até 2.11.0 Google OAuth Login handle-oauth-callback-url.ts Autenticação fraca] |
|---|
| Pontos | 20 |
|---|