# CVE-2026-47677: FacturaScripts authentication bypass in two-factor validation

Source: https://junglewise.ai/threats/cve-2026-47677-facturascripts-authentication-bypass-in-two-factor-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-47677 · Severity: critical · CVSS 4 · Published 2026-07-13

FacturaScripts, an open-source ERP and accounting software, contains a critical flaw in its login process. An attacker can bypass security protections to take over any user account that has two-factor authentication (2FA) enabled, without needing the user's password. This could allow unauthorized access to sensitive business data, including invoices, customer information, and financial records.

Technologies: [NeoRazorX FacturaScripts](https://junglewise.ai/threats/technologies/facturascripts), [facturascripts/facturascripts (Packagist)](https://junglewise.ai/threats/technologies/facturascripts-facturascripts). Vendors: [NeoRazorX](https://junglewise.ai/threats/vendors/neorazorx), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-47677 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47677 being exploited in the wild.

**How severe is CVE-2026-47677?** Critical severity, with a CVSS score of 4, published 13 July 2026.

**Which products and versions are affected?** NeoRazorX FacturaScripts <= 2026.2; facturascripts/facturascripts (Packagist) <= 2026.2, ECOSYSTEM:introduced=0,fixed=2026.3.

**Is there a fix for CVE-2026-47677?** Yes. facturascripts/facturascripts (Packagist): upgrade to 2026.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47677 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-47677?** Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- facturascripts/facturascripts (Packagist): upgrade to 2026.3 or later

  ```sh
  composer require facturascripts/facturascripts:^2026.3
  ```


## Technical details

The `twoFactorValidationAction` method in `Core/Controller/Login.php` fails to verify that a user has successfully completed the password authentication step before processing 2FA codes. Additionally, the endpoint lacks CSRF protection and does not implement rate-limiting, despite other login actions doing so. Because the application uses a large verification window (allowing 17 valid codes simultaneously), an attacker can successfully brute-force the 6-digit TOTP code in a short period. A successful exploit results in a valid session cookie for the target user. The vulnerability is patched in version 2026.3.

## Affected products

- NeoRazorX facturascripts <= 2026.2

## Identifiers

- CVE-2026-47677
- GHSA-c67f-gmxw-mj93

## Timeline

- 2026-05-13: other: Vulnerability identified in master branch commit 7392b489b
- 2026-07-13: advisory: GHSA-c67f-gmxw-mj93 published
- 2026-07-13: patched: Fixed in version 2026.3

## References

- [https://api.github.com/users/janssensjelle](https://api.github.com/users/janssensjelle)
- [https://github.com/janssensjelle](https://github.com/janssensjelle)
- [https://api.github.com/users/janssensjelle/gists%7B/gist_id%7D](https://api.github.com/users/janssensjelle/gists%7B/gist_id%7D)
- [https://api.github.com/users/janssensjelle/repos](https://api.github.com/users/janssensjelle/repos)
- [https://avatars.githubusercontent.com/u/10356515?v=4](https://avatars.githubusercontent.com/u/10356515?v=4)
- [https://api.github.com/users/janssensjelle/events%7B/privacy%7D](https://api.github.com/users/janssensjelle/events%7B/privacy%7D)

## Related threats

- [FacturaScripts PHP object injection in WidgetSelect](https://junglewise.ai/threats/cve-2026-104905-facturascripts-before-version-2026-7-contains-a-php-object)
- [FacturaScripts path traversal and RCE in UploadedFile move](https://junglewise.ai/threats/facturascripts-path-traversal-and-rce-in-uploadedfile-move-40e5093b)
- [FacturaScripts stored XSS in WidgetVariante and WidgetSubcuenta](https://junglewise.ai/threats/cve-2026-45710-facturascripts-stored-xss-in-widgetvariante-and-widgetsubcuenta)
- [FacturaScripts CSV formula injection in CSVExport](https://junglewise.ai/threats/cve-2026-45263-facturascripts-csv-formula-injection-in-csvexport)
- [FacturaScripts path traversal in static file controllers](https://junglewise.ai/threats/cve-2026-45693-facturascripts-path-traversal-in-static-file-controllers)