Is CVE-2026-13543 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13543 being exploited in the wild.

How severe is CVE-2026-13543?

Medium severity, with a CVSS score of 5.6, published 29 June 2026.

Is there a fix for CVE-2026-13543?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13543 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-13543?

Check whether you run Documenso at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13543: Documenso 2FA bypass in Google OAuth Login

CVE-2026-13543 · Severity: medium · CVSS 5.6 · Published 2026-06-29

Documenso, an open-source digital signature platform, contains a security flaw where users can bypass two-factor authentication (2FA). While 2FA is correctly required for standard email and password logins, an attacker who gains access to a user's linked Google account can sign in directly without being prompted for a second security code. This undermines the protection 2FA provides against unauthorized account access.

Technologies: Documenso. Vendors: Documenso.

Quick answers

Is CVE-2026-13543 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13543 being exploited in the wild.
How severe is CVE-2026-13543?: Medium severity, with a CVSS score of 5.6, published 29 June 2026.
Which products and versions are affected?: Documenso up to 2.11.0.
Is there a fix for CVE-2026-13543?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13543 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-13543?: Check whether you run Documenso at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authentication vulnerability (CWE-287) exists in Documenso's Google OAuth implementation within 'packages/auth/server/lib/utils/handle-oauth-callback-url.ts'. While the application enforces TOTP-based 2FA for local credentials, the OAuth callback flow fails to check the 'twoFactorEnabled' status of the account. Consequently, a successful OAuth handshake immediately grants a full session, bypassing the 2FA challenge. An attacker with control over a user's Google account can gain unauthorized access to the Documenso account even if 2FA is enabled. A fix involving a pending 2FA state cookie and a dedicated verification endpoint has been proposed in pull request #2837.

Affected products

Documenso Documenso up to 2.11.0

Timeline

2026-05-02: disclosed: Issue reported via GitHub bug bounty report #2758
2026-05-20: other: Fix proposed in pull request #2837
2026-06-29: advisory: CVE-2026-13543 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.