# CVE-2026-76143: Genian SSL PNS multi-factor authentication bypass via os_type parameter

Source: https://junglewise.ai/threats/cve-2026-76143-a-missing-authorization-vulnerability-in-genian-ssl-pns-allows-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-76143 · Severity: info · Published 2026-10-01

Genian SSL PNS is a network access control product that uses multi-factor authentication to verify user identity. An attacker can bypass this authentication by manipulating a single request parameter, granting unauthorized access to protected networks without knowing the user's second factor credentials.

Technologies: [Genian SSL PNS](https://junglewise.ai/threats/technologies/ssl-pns). Vendors: [Genian](https://junglewise.ai/threats/vendors/genian).

## Quick answers

**Is CVE-2026-76143 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76143 being exploited in the wild.

**How severe is CVE-2026-76143?** Informational severity, published 1 October 2026.

**Which products and versions are affected?** Genian SSL PNS before 5.0.0.

**Is there a fix for CVE-2026-76143?** Yes: fixed in 5.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76143 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-76143?** Check whether you run Genian SSL PNS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.0.0

## Technical details

A missing authorization check in the account authentication process allows an attacker to set the os_type parameter to 0 during login, causing the server to skip MFA verification. This is a network-accessible vulnerability requiring only low privileges and no user interaction, granting an attacker the ability to impersonate legitimate users and access confidential network resources.

## Affected products

- Genian SSL PNS before 5.0.0

## Timeline

- 2026-07-10: disclosed
- 2026-06-08: patched
- 2026-04-08: other: reported

## References

- [https://github.com/genians/security-research/security/advisories/GHSA-gf55-r82f-x8m8](https://github.com/genians/security-research/security/advisories/GHSA-gf55-r82f-x8m8)

## Related threats

- [Genian SSL PNS command injection in authentication](https://junglewise.ai/threats/cve-2026-76146-an-os-command-injection-vulnerability-in-genian-ssl-pns-allows-an)
- [Genian SSL PNS privilege escalation in user registration](https://junglewise.ai/threats/cve-2026-76145-an-improper-privilege-management-vulnerability-in-genian-ssl-pns)