Is CVE-2026-47677 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47677 being exploited in the wild.

How severe is CVE-2026-47677?

Critical severity, with a CVSS score of 4, published 13 July 2026.

Which products and versions are affected?

NeoRazorX FacturaScripts <= 2026.2; facturascripts/facturascripts (Packagist) <= 2026.2, ECOSYSTEM:introduced=0,fixed=2026.3.

Is there a fix for CVE-2026-47677?

Yes. facturascripts/facturascripts (Packagist): upgrade to 2026.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47677 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-47677?

Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47677: FacturaScripts authentication bypass in two-factor validation

Q: Is there a fix for CVE-2026-47677?

Yes. facturascripts/facturascripts (Packagist): upgrade to 2026.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47677 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-47677?

Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47677 · Severity: critical · CVSS 4 · Published 2026-07-13

FacturaScripts, an open-source ERP and accounting software, contains a critical flaw in its login process. An attacker can bypass security protections to take over any user account that has two-factor authentication (2FA) enabled, without needing the user's password. This could allow unauthorized access to sensitive business data, including invoices, customer information, and financial records.

Technologies: NeoRazorX FacturaScripts, facturascripts/facturascripts (Packagist). Vendors: NeoRazorX, Packagist.

Quick answers

Is CVE-2026-47677 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47677 being exploited in the wild.
How severe is CVE-2026-47677?: Critical severity, with a CVSS score of 4, published 13 July 2026.
Which products and versions are affected?: NeoRazorX FacturaScripts <= 2026.2; facturascripts/facturascripts (Packagist) <= 2026.2, ECOSYSTEM:introduced=0,fixed=2026.3.
Is there a fix for CVE-2026-47677?: Yes. facturascripts/facturascripts (Packagist): upgrade to 2026.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47677 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-47677?: Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

facturascripts/facturascripts (Packagist): upgrade to 2026.3 or later
```
composer require facturascripts/facturascripts:^2026.3
```

Technical details

The `twoFactorValidationAction` method in `Core/Controller/Login.php` fails to verify that a user has successfully completed the password authentication step before processing 2FA codes. Additionally, the endpoint lacks CSRF protection and does not implement rate-limiting, despite other login actions doing so. Because the application uses a large verification window (allowing 17 valid codes simultaneously), an attacker can successfully brute-force the 6-digit TOTP code in a short period. A successful exploit results in a valid session cookie for the target user. The vulnerability is patched in version 2026.3.

Affected products

NeoRazorX facturascripts <= 2026.2

Identifiers

CVE-2026-47677
GHSA-c67f-gmxw-mj93

Timeline

2026-05-13: other: Vulnerability identified in master branch commit 7392b489b
2026-07-13: advisory: GHSA-c67f-gmxw-mj93 published
2026-07-13: patched: Fixed in version 2026.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.