Summary Logic error in 2FA verification condition allows bypass of two-factor authentication Details https://github.com/komari-monitor/komari/blob/bd5a6934e1b79a12cf1e6a9bba5372d0e04f3abc/api/login.go#L55 There is no way for Verify2Fa to return an error AND true as ok at the same time, any codes are considered as valid. PoC Use any 6 digits as 2FA code Impact Bypass 2FA…Read More
GHSA-JHMR-57CJ-Q6G9 Komari vulnerable to 2FA Authentication Bypass
