CVE-2026-40177 CRITICAL

CVE-2026-40177: Password bypass when 2FA is activated

Vendor Ajenti

Product ajenti

Weakness CWE-287 · Improper authentication

Published April 10, 2026

Last update April 14, 2026

View on NVD All CVEs

CVSS base score

9.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible to bypass the password authentication This vulnerability is fixed in 0.112.

Key dates

02Disclosure timeline

April 10, 2026 CVE published

April 14, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-40177 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/287.html

Related vulnerabilities

04Related CVE

CVE-2021-25036 All In One SEO < 4.1.5.3 - Authenticated Privilege Escalation CVE-2026-4592 kalcaddle kodbox Password Login index.class.php tfaVerify improper authentication CVE-2026-33042 Parse Server affected by empty authData bypassing credential requirement on signup CVE-2021-39165 Unauthenticated SQL Injection CVE-2026-7630 innocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authentication