Security Advisory

CVE-2026-28510

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-05 12:28:10

Last updated 2026-05-06 14:14:19

Assigner GitHub_M

CVSS score 5.9

State PUBLISHED

Description

eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication state across authentication steps. Under certain conditions, an attacker with valid primary credentials could complete authentication with an attacker-controlled TOTP secret and bypass the additional factor. This could result in unauthorized account access. This issue is fixed in version 5.4.2.

← Browse all CVEs View on cve.org ↗