Executive brief
EspoCRM is an open-source customer relationship management platform used by businesses to manage customer data and sales processes. A security flaw allows a user to bypass two-factor authentication (2FA) and log into another person's account if both users happen to use the same password. This could lead to unauthorized access to sensitive business information, customer records, and administrative functions.
Technical details
An authentication token reuse vulnerability exists in EspoCRM versions 5.7.0 through 5.8.5 (prior to 5.9.0) within the 'application/Espo/Core/Utils/Authentication/Espo.php' component. The root cause is that authentication tokens are bound to password hashes rather than unique per-user identifiers. An attacker with a valid account can generate an authentication token for their own account and replay it against a victim's account if both accounts share the same password. This allows the attacker to bypass the victim's two-factor authentication (2FA) protections. The vulnerability was addressed in version 5.9.0 by ensuring tokens are validated against specific user IDs.
Affected products
- EspoCRM EspoCRM 5.7.0 to 5.8.5
Timeline
- 2020-04-24: disclosed: Initial exploit details published on Exploit-DB
- 2026-02-03: advisory: CVE-2020-37094 published/updated with detailed 2FA bypass description