CVE-2026-4208 HIGH

CVE-2026-4208: Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)

Vendor Typo3
Product Extension "E-Mail MFA Provider"
Weakness CWE-639 · IDOR
Published March 17, 2026
Last update March 24, 2026
View on NVD All CVEs

CVSS base score

7.7/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.

Key dates

02Disclosure timeline

March 17, 2026 CVE published
March 24, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-11690 IDOR vulnerability in the CFMOTO RIDE API CVE-2026-2366 Keycloak: keycloak: information disclosure via authorization bypass in admin api CVE-2026-8679 AudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter CVE-2024-10770 Envo Extra <= 1.9.3 - Authenticated (Contributor+) Post Disclosure CVE-2025-57994 WordPress Upcoming Events Lists Plugin <= 1.4.0 - Insecure Direct Object References (IDOR) Vulnerability