GHSA-jhmr-57cj-q6g9

Описание

Summary

Logic error in 2FA verification condition allows bypass of two-factor authentication

Details

https://github.com/komari-monitor/komari/blob/bd5a6934e1b79a12cf1e6a9bba5372d0e04f3abc/api/login.go#L55

There is no way for Verify2Fa to return an error AND true as ok at the same time, any codes are considered as valid.

PoC

Use any 6 digits as 2FA code

Impact

Bypass 2FA Authentication