CVE-2026-4208 — Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)
The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty…
Published: 2026-03-17 · CVSS: 7.7 · CVSS 4.0
The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7