| tiêu đề | documenso v2.11.0 Authentication Bypass |
|---|
| Mô tả | A vulnerability in Documenso allows two-factor authentication (2FA) bypass through inconsistent authentication enforcement across login methods. When users authenticate using email/password credentials, 2FA verification is enforced as expected. However, when the same account authenticates through Google OAuth, the application grants full authenticated access without requiring the configured second authentication factor.
This vulnerability allows attackers who have obtained access to a victim’s linked Google account credentials, OAuth session, or federated authentication access to bypass the intended multi-factor authentication protection mechanism, resulting in unauthorized account access and reduced account security. The issue stems from authentication policy inconsistency between local and federated authentication flows.
|
|---|
| Nguồn | ⚠️ https://github.com/documenso/documenso/issues/2758 |
|---|
| Người dùng | Jeetpal2007 (UID 98616) |
|---|
| Đệ trình | 29/05/2026 09:37 (cách đây 4 các tháng) |
|---|
| Kiểm duyệt | 28/06/2026 12:12 (1 month later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 374551 [Documenso đến 2.11.0 Google OAuth Login handle-oauth-callback-url.ts xác thực yếu] |
|---|
| điểm | 20 |
|---|