# CVE-2024-27928: vantage6 two-factor authentication bypass via email reset

Source: https://junglewise.ai/threats/cve-2024-27928-vantage6-two-factor-authentication-bypass-via-email-reset  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2024-27928 · Severity: medium · CVSS 4 · Published 2026-06-17

vantage6 is an open-source platform used for privacy-preserving data analysis. A security flaw allows an attacker who has gained access to a user's email account to bypass two-factor authentication (2FA) by resetting both the account password and the 2FA token via email. This effectively reduces the security of the platform to a single factor, potentially allowing unauthorized access to sensitive research data if the user's email is compromised.

Technologies: [vantage6 (PyPI)](https://junglewise.ai/threats/technologies/vantage6). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-27928 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-27928 being exploited in the wild.

**How severe is CVE-2024-27928?** Medium severity, with a CVSS score of 4, published 17 June 2026.

**Which products and versions are affected?** vantage6 (PyPI) < 5.0.0, ECOSYSTEM:introduced=0,fixed=5.0.0.

**Is there a fix for CVE-2024-27928?** Yes. vantage6 (PyPI): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-27928 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-27928?** Check whether you run vantage6 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vantage6 (PyPI): upgrade to 5.0.0 or later

  ```sh
  pip install "vantage6>=5.0.0"
  ```


## Technical details

A vulnerability in vantage6 prior to version 5.0.0 allows for the circumvention of multi-factor authentication (MFA). The application's recovery logic permits resetting both the user password and the 2FA token through email-based workflows. If an attacker compromises a user's email account, they can perform these resets sequentially to gain full access to the vantage6 account, effectively reducing the authentication mechanism to a single factor (CWE-308). This issue is addressed in version 5.0.0 by changing how 2FA tokens are managed or reset. No workarounds are available other than upgrading.

## Affected products

- vantage6 vantage6 < 5.0.0

## Identifiers

- CVE-2024-27928
- GHSA-4c5c-2vc3-x5w2
- PYSEC-2026-3398

## Timeline

- 2026-06-05: advisory: GitHub Security Advisory GHSA-4c5c-2vc3-x5w2 published
- 2026-06-17: disclosed: CVE-2024-27928 published to NVD
- 2026-06-17: patched: Version 5.0.0 released to fix the issue

## References

- [https://github.com/vantage6/vantage6/blob/main/docs/release_notes.rst](https://github.com/vantage6/vantage6/blob/main/docs/release_notes.rst)
- [https://github.com/vantage6/vantage6/issues/1932](https://github.com/vantage6/vantage6/issues/1932)
- [https://github.com/vantage6/vantage6/security/advisories/GHSA-4c5c-2vc3-x5w2](https://github.com/vantage6/vantage6/security/advisories/GHSA-4c5c-2vc3-x5w2)

## Related threats

- [PYSEC-2026-3703 - vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review](https://junglewise.ai/threats/cve-2026-73652-vantage6-algorithm-developer-can-edit-another-developer-s)
- [PYSEC-2026-2007 - vantage6 collaboration admins can extend their influence by expanding the collaboration](https://junglewise.ai/threats/cve-2024-32969-vantage6-collaboration-admins-can-extend-their-influence-by)
- [PYSEC-2026-2005 - vantage6 vulnerable to a username timing attack on recover password/MFA token](https://junglewise.ai/threats/cve-2024-24770-vantage6-vulnerable-to-a-username-timing-attack-on-recover)
- [PYSEC-2026-2004 - vantage6's CORS settings overly permissive](https://junglewise.ai/threats/cve-2024-23823-vantage6-s-cors-settings-overly-permissive)
- [PYSEC-2026-2008 - vantage6 vulnerable to username timing attack](https://junglewise.ai/threats/cve-2024-21671-vantage6-vulnerable-to-username-timing-attack)