Executive brief
eduMFA is a multi-factor authentication (MFA) solution used to secure user logins. A flaw in the system allows an attacker to trigger a 'failed login' count for every user within a specific group simultaneously. If exploited, this could lead to a widespread lockout of legitimate users, causing a significant disruption to business operations and services.
Technical details
A vulnerability in the `/validate/check` endpoint of eduMFA exists due to improper input validation (CWE-20). When a request includes a valid 'resolver' parameter but specifies a non-existent user, the application incorrectly increments the failcounters for all tokens associated with that resolver. An attacker with network access and low privileges can exploit this behavior to reach the maximum failure threshold for all users in a resolver, effectively locking them out of the system. This issue is resolved in version 2.9.1. Workarounds include restricting access to the validation endpoint using API keys or reverse proxy rules.
Affected products
- eduMFA eduMFA < 2.9.1
Timeline
- 2026-05-11: disclosed
- 2026-05-18: advisory
- 2026-05-18: patched: Fixed in version 2.9.1