Quick answers
- Is CVE-2020-37094 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-37094 being exploited in the wild.
- How severe is CVE-2020-37094?
- High severity, with a CVSS score of 8.1, published 3 February 2026.
- Which products and versions are affected?
- Espocrm 5.7.0 to 5.8.5.
- Is there a fix for CVE-2020-37094?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2020-37094 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2020-37094?
- Check whether you run Espocrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An authentication token reuse vulnerability exists in EspoCRM versions 5.7.0 through 5.8.5 (prior to 5.9.0) within the 'application/Espo/Core/Utils/Authentication/Espo.php' component. The root cause is that authentication tokens are bound to password hashes rather than unique per-user identifiers. An attacker with a valid account can generate an authentication token for their own account and replay it against a victim's account if both accounts share the same password. This allows the attacker to bypass the victim's two-factor authentication (2FA) protections. The vulnerability was addressed in version 5.9.0 by ensuring tokens are validated against specific user IDs.
Affected products
- EspoCRM EspoCRM 5.7.0 to 5.8.5
Timeline
- 2020-04-24: disclosed: Initial exploit details published on Exploit-DB
- 2026-02-03: advisory: CVE-2020-37094 published/updated with detailed 2FA bypass description