Executive brief
eduMFA is a multi-factor authentication (MFA) solution. A vulnerability in how it handles database transactions could allow an attacker to reuse one-time security tokens (like TOTP or HOTP) that should expire after a single use. This could potentially allow an unauthorized user to bypass authentication protections if they can successfully time their requests during a login attempt.
Technical details
A race condition exists in eduMFA due to incorrect InnoDB snapshot isolation when using MySQL or certain versions of MariaDB. The application fails to properly isolate database transactions, which can allow a single-use token (TOTP, HOTP, or WebAuthn) to be validated multiple times if multiple authentication requests are processed simultaneously. This occurs when 'innodb_snapshot_isolation' is disabled or unavailable in the underlying database. The vulnerability is fixed in version 2.9.1 by implementing explicit row-level locking using 'SELECT FOR UPDATE' before performing write operations. A database-level workaround involves enabling 'innodb_snapshot_isolation' where supported.
Affected products
- eduMFA eduMFA < 2.9.1
Timeline
- 2026-05-11: disclosed
- 2026-05-18: advisory