| 标题 | documenso v2.11.0 Authentication Bypass |
|---|
| 描述 | A vulnerability in Documenso allows two-factor authentication (2FA) bypass through inconsistent authentication enforcement across login methods. When users authenticate using email/password credentials, 2FA verification is enforced as expected. However, when the same account authenticates through Google OAuth, the application grants full authenticated access without requiring the configured second authentication factor.
This vulnerability allows attackers who have obtained access to a victim’s linked Google account credentials, OAuth session, or federated authentication access to bypass the intended multi-factor authentication protection mechanism, resulting in unauthorized account access and reduced account security. The issue stems from authentication policy inconsistency between local and federated authentication flows.
|
|---|
| 来源 | ⚠️ https://github.com/documenso/documenso/issues/2758 |
|---|
| 用户 | Jeetpal2007 (UID 98616) |
|---|
| 提交 | 2026-05-29 09時37分 (4 月前) |
|---|
| 管理 | 2026-06-28 12時12分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 374551 [Documenso 直到 2.11.0 Google OAuth Login handle-oauth-callback-url.ts 弱身份验证] |
|---|
| 积分 | 20 |
|---|