# CVE-2026-13543: Documenso 2FA bypass in Google OAuth Login

Source: https://junglewise.ai/threats/cve-2026-13543-documenso-2fa-bypass-in-google-oauth-login  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-13543 · Severity: medium · CVSS 5.6 · Published 2026-06-29

Documenso, an open-source digital signature platform, contains a security flaw where users can bypass two-factor authentication (2FA). While 2FA is correctly required for standard email and password logins, an attacker who gains access to a user's linked Google account can sign in directly without being prompted for a second security code. This undermines the protection 2FA provides against unauthorized account access.

Technologies: [Documenso](https://junglewise.ai/threats/technologies/documenso). Vendors: [Documenso](https://junglewise.ai/threats/vendors/documenso).

## Quick answers

**Is CVE-2026-13543 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13543 being exploited in the wild.

**How severe is CVE-2026-13543?** Medium severity, with a CVSS score of 5.6, published 29 June 2026.

**Which products and versions are affected?** Documenso up to 2.11.0.

**Is there a fix for CVE-2026-13543?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13543 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-13543?** Check whether you run Documenso at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authentication vulnerability (CWE-287) exists in Documenso's Google OAuth implementation within 'packages/auth/server/lib/utils/handle-oauth-callback-url.ts'. While the application enforces TOTP-based 2FA for local credentials, the OAuth callback flow fails to check the 'twoFactorEnabled' status of the account. Consequently, a successful OAuth handshake immediately grants a full session, bypassing the 2FA challenge. An attacker with control over a user's Google account can gain unauthorized access to the Documenso account even if 2FA is enabled. A fix involving a pending 2FA state cookie and a dedicated verification endpoint has been proposed in pull request #2837.

## Affected products

- Documenso Documenso up to 2.11.0

## Timeline

- 2026-05-02: disclosed: Issue reported via GitHub bug bounty report #2758
- 2026-05-20: other: Fix proposed in pull request #2837
- 2026-06-29: advisory: CVE-2026-13543 published

## References

- [https://github.com/documenso/documenso/](https://github.com/documenso/documenso/)
- [https://github.com/documenso/documenso/issues/2758](https://github.com/documenso/documenso/issues/2758)
- [https://github.com/documenso/documenso/pull/2837](https://github.com/documenso/documenso/pull/2837)
- [https://vuldb.com/cve/CVE-2026-13543](https://vuldb.com/cve/CVE-2026-13543)
- [https://vuldb.com/submit/842579](https://vuldb.com/submit/842579)
- [https://vuldb.com/vuln/374551](https://vuldb.com/vuln/374551)
- [https://vuldb.com/vuln/374551/cti](https://vuldb.com/vuln/374551/cti)

## Related threats

- [Documenso access control bypass in PDF-serving endpoint](https://junglewise.ai/threats/cve-2026-85697-documenso-access-control-bypass-in-pdf-serving-endpoint)
- [Documenso unauthenticated PDF file upload](https://junglewise.ai/threats/cve-2026-82472-documenso-unauthenticated-pdf-file-upload)