CVE-2026-47677: FacturaScripts authentication bypass in two-factor validation

Executive brief

FacturaScripts, an open-source ERP and accounting software, contains a critical flaw in its login process. An attacker can bypass security protections to take over any user account that has two-factor authentication (2FA) enabled, without needing the user's password. This could allow unauthorized access to sensitive business data, including invoices, customer information, and financial records.

Technical details

The `twoFactorValidationAction` method in `Core/Controller/Login.php` fails to verify that a user has successfully completed the password authentication step before processing 2FA codes. Additionally, the endpoint lacks CSRF protection and does not implement rate-limiting, despite other login actions doing so. Because the application uses a large verification window (allowing 17 valid codes simultaneously), an attacker can successfully brute-force the 6-digit TOTP code in a short period. A successful exploit results in a valid session cookie for the target user. The vulnerability is patched in version 2026.3.

Affected products

• NeoRazorX facturascripts <= 2026.2

Timeline

• 2026-05-13: other: Vulnerability identified in master branch commit 7392b489b
• 2026-07-13: advisory: GHSA-c67f-gmxw-mj93 published
• 2026-07-13: patched: Fixed in version 2026.3

References

• https://api.github.com/users/janssensjelle
• https://github.com/janssensjelle
• https://api.github.com/users/janssensjelle/gists%7B/gist_id%7D
• https://api.github.com/users/janssensjelle/repos
• https://avatars.githubusercontent.com/u/10356515?v=4
• https://api.github.com/users/janssensjelle/events%7B/privacy%7D