CVE-2024-27928: vantage6 two-factor authentication bypass via email reset

CVE-2024-27928 · Severity: medium · CVSS 4 · Published 2026-06-17

vantage6 is an open-source platform used for privacy-preserving data analysis. A security flaw allows an attacker who has gained access to a user's email account to bypass two-factor authentication (2FA) by resetting both the account password and the 2FA token via email. This effectively reduces the security of the platform to a single factor, potentially allowing unauthorized access to sensitive research data if the user's email is compromised.

Technologies: vantage6 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-27928 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-27928 being exploited in the wild.
How severe is CVE-2024-27928?
Medium severity, with a CVSS score of 4, published 17 June 2026.
Which products and versions are affected?
vantage6 (PyPI) < 5.0.0, ECOSYSTEM:introduced=0,fixed=5.0.0.
Is there a fix for CVE-2024-27928?
Yes. vantage6 (PyPI): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-27928 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-27928?
Check whether you run vantage6 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • vantage6 (PyPI): upgrade to 5.0.0 or later
    pip install "vantage6>=5.0.0"

Technical details

A vulnerability in vantage6 prior to version 5.0.0 allows for the circumvention of multi-factor authentication (MFA). The application's recovery logic permits resetting both the user password and the 2FA token through email-based workflows. If an attacker compromises a user's email account, they can perform these resets sequentially to gain full access to the vantage6 account, effectively reducing the authentication mechanism to a single factor (CWE-308). This issue is addressed in version 5.0.0 by changing how 2FA tokens are managed or reset. No workarounds are available other than upgrading.

Affected products

  • vantage6 vantage6 < 5.0.0

Identifiers

  • CVE-2024-27928
  • GHSA-4c5c-2vc3-x5w2
  • PYSEC-2026-3398

Timeline

  • 2026-06-05: advisory: GitHub Security Advisory GHSA-4c5c-2vc3-x5w2 published
  • 2026-06-17: disclosed: CVE-2024-27928 published to NVD
  • 2026-06-17: patched: Version 5.0.0 released to fix the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.