Описание
scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token
Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication.
Пакеты
Наименование
scheb/two-factor-bundle
composer
Затронутые версииВерсия исправления
>= 3.0.0, < 3.7.0
3.7.0
7.4 High
CVSS3
Дефекты
CWE-287
7.4 High
CVSS3
Дефекты
CWE-287