| tiêu đề | baserow c34eb053be98bc0d04fcbf9b2d6b305cba0d5647 CWE-287 Improper Authentication |
|---|
| Mô tả | Baserow's 2FA verification can use a temporary 2FA token issued for one account while selecting the 2FA provider and final login account from the request body email. An attacker can log in with their own password to obtain a temporary 2FA token, then submit a verification request containing the victim's email and victim's current TOTP or backup code. If accepted, the server returns a session for the victim, allowing authentication factors from two different accounts to be spliced together. |
|---|
| Nguồn | ⚠️ https://github.com/baserow/baserow/blob/c34eb053be98bc0d04fcbf9b2d6b305cba0d5647/backend/src/baserow/api/two_factor_auth/views.py#L213 |
|---|
| Người dùng | GalaxynX (UID 98977) |
|---|
| Đệ trình | 13/06/2026 13:49 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 04/08/2026 14:54 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 385815 [Baserow đến 2.3.2 2FA Verify Endpoint views.py verify xác thực yếu] |
|---|
| điểm | 20 |
|---|