CVE-2026-4208: Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)

Executive brief

The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.

References

• https://api.github.com/users/MrSilaz
• https://github.com/MrSilaz
• https://api.github.com/users/MrSilaz/gists%7B/gist_id%7D
• https://api.github.com/users/MrSilaz/repos
• https://avatars.githubusercontent.com/u/4735908?v=4
• https://api.github.com/users/MrSilaz/events%7B/privacy%7D