# CVE-2020-37094: EspoCRM 2FA bypass via authentication token reuse

Source: https://junglewise.ai/threats/cve-2020-37094-espocrm-2fa-bypass-via-authentication-token-reuse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-03. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2020-37094 · Severity: high · CVSS 8.1 · Published 2026-02-03

EspoCRM is an open-source customer relationship management platform used by businesses to manage customer data and sales processes. A security flaw allows a user to bypass two-factor authentication (2FA) and log into another person's account if both users happen to use the same password. This could lead to unauthorized access to sensitive business information, customer records, and administrative functions.

Technologies: [Espocrm](https://junglewise.ai/threats/technologies/espocrm). Vendors: [Espocrm](https://junglewise.ai/threats/vendors/espocrm).

## Quick answers

**Is CVE-2020-37094 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-37094 being exploited in the wild.

**How severe is CVE-2020-37094?** High severity, with a CVSS score of 8.1, published 3 February 2026.

**Which products and versions are affected?** Espocrm 5.7.0 to 5.8.5.

**Is there a fix for CVE-2020-37094?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2020-37094 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2020-37094?** Check whether you run Espocrm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication token reuse vulnerability exists in EspoCRM versions 5.7.0 through 5.8.5 (prior to 5.9.0) within the 'application/Espo/Core/Utils/Authentication/Espo.php' component. The root cause is that authentication tokens are bound to password hashes rather than unique per-user identifiers. An attacker with a valid account can generate an authentication token for their own account and replay it against a victim's account if both accounts share the same password. This allows the attacker to bypass the victim's two-factor authentication (2FA) protections. The vulnerability was addressed in version 5.9.0 by ensuring tokens are validated against specific user IDs.

## Affected products

- EspoCRM EspoCRM 5.7.0 to 5.8.5

## Timeline

- 2020-04-24: disclosed: Initial exploit details published on Exploit-DB
- 2026-02-03: advisory: CVE-2020-37094 published/updated with detailed 2FA bypass description

## References

- [https://github.com/espocrm/espocrm/commit/b299220dd0c7acdaa1ed8be8ffd79c7985093c7a](https://github.com/espocrm/espocrm/commit/b299220dd0c7acdaa1ed8be8ffd79c7985093c7a)
- [https://www.espocrm.com/](https://www.espocrm.com/)
- [https://www.exploit-db.com/exploits/48376](https://www.exploit-db.com/exploits/48376)
- [https://www.vulncheck.com/advisories/espocrm-two-factor-auth-bypass-via-auth-token-reuse-between-accounts-with-identical-passwords](https://www.vulncheck.com/advisories/espocrm-two-factor-auth-bypass-via-auth-token-reuse-between-accounts-with-identical-passwords)

## Related threats

- [EspoCRM denial of service in password-redaction regex](https://junglewise.ai/threats/cve-2026-118686-espocrm-before-9-3-11-and-10-x-before-10-0-8-contains-a-denial)
- [EspoCRM authorization bypass in PDF image rendering](https://junglewise.ai/threats/cve-2026-113643-a-vulnerability-was-found-in-espocrm-up-to-9-3-10-10-0-10-this)
- [EspoCRM mass-update attachment access control bypass](https://junglewise.ai/threats/cve-2026-75505-espocrm-is-an-open-source-customer-relationship-management)
- [EspoCRM HTML injection in email notifications](https://junglewise.ai/threats/cve-2026-59994-espocrm-is-an-open-source-customer-relationship-management)
- [EspoCRM CSV/XLSX formula injection via whitespace bypass](https://junglewise.ai/threats/cve-2026-55154-espocrm-is-an-open-source-customer-relationship-management)