CVE-2026-40178: Ajenti 2FA authentication bypass in ajenti.plugin.core

Executive brief

Ajenti suffers from a race condition in its core plugin that allows attackers to bypass two-factor authentication (2FA) during a brief window following initial user authentication.

Affected products

• ajenti ajenti_plugin_core
• PyPI ajenti-plugin-core

References

• https://api.github.com/users/hansmach1ne
• https://github.com/hansmach1ne
• https://api.github.com/users/hansmach1ne/gists%7B/gist_id%7D
• https://api.github.com/users/hansmach1ne/repos
• https://avatars.githubusercontent.com/u/57464251?v=4
• https://api.github.com/users/hansmach1ne/events%7B/privacy%7D