Executive brief
Documenso, an open-source digital signature platform, contains a security flaw where users can bypass two-factor authentication (2FA). While 2FA is correctly required for standard email and password logins, an attacker who gains access to a user's linked Google account can sign in directly without being prompted for a second security code. This undermines the protection 2FA provides against unauthorized account access.
Technical details
An improper authentication vulnerability (CWE-287) exists in Documenso's Google OAuth implementation within 'packages/auth/server/lib/utils/handle-oauth-callback-url.ts'. While the application enforces TOTP-based 2FA for local credentials, the OAuth callback flow fails to check the 'twoFactorEnabled' status of the account. Consequently, a successful OAuth handshake immediately grants a full session, bypassing the 2FA challenge. An attacker with control over a user's Google account can gain unauthorized access to the Documenso account even if 2FA is enabled. A fix involving a pending 2FA state cookie and a dedicated verification endpoint has been proposed in pull request #2837.
Affected products
- Documenso Documenso up to 2.11.0
Timeline
- 2026-05-02: disclosed: Issue reported via GitHub bug bounty report #2758
- 2026-05-20: other: Fix proposed in pull request #2837
- 2026-06-29: advisory: CVE-2026-13543 published