Executive brief
eduMFA is a multi-factor authentication solution. In versions prior to 2.9.1, the system fails to properly expire authentication challenges used for Passkey and WebAuthn logins. This could allow an attacker to reuse old authentication data to bypass security measures and gain unauthorized access to user accounts.
Technical details
A vulnerability in eduMFA versions prior to 2.9.1 stems from insufficient session expiration (CWE-613) and improper authentication (CWE-287) within the userless Passkey/WebAuthn implementation. Specifically, authentication challenges lack an expiration flag or validity information, allowing them to be replayed indefinitely. A remote attacker can exploit this by capturing and reusing a valid challenge response to authenticate without possessing the original hardware token or passkey at the time of login. The issue is resolved in version 2.9.1 by incorporating validity metadata into the challenges.
Affected products
- eduMFA eduMFA < 2.9.1
Timeline
- 2026-05-11: disclosed: Initial disclosure by researcher
- 2026-05-18: advisory: GitHub Advisory published
- 2026-05-18: patched: Fix released in version 2.9.1