CVE-2026-40177: Ajenti plugin core password bypass when 2FA is enabled

Executive brief

Ajenti plugin core allows attackers to bypass password authentication when two-factor authentication (2FA) is enabled. This vulnerability affects versions prior to 0.112 and is resolved in the 0.112 release.

Affected products

• ajenti ajenti_plugin_core
• PyPI ajenti-plugin-core

References

• https://api.github.com/users/hansmach1ne
• https://github.com/hansmach1ne
• https://api.github.com/users/hansmach1ne/gists%7B/gist_id%7D
• https://api.github.com/users/hansmach1ne/repos
• https://avatars.githubusercontent.com/u/57464251?v=4
• https://api.github.com/users/hansmach1ne/events%7B/privacy%7D