Umami CVE-2026-121531

Exploitation requires a deployment where an administrator has configured an enforced/mandatory 2FA policy - with no such policy there is no second factor to bypass. The attacker must also already hold valid first-factor credentials (username and password), reflected by PR:L in the supplied vector; this is not a credential-less takeover. The precise manipulation that causes the login handler to skip the 2FA check is not described in the available sources. Limiting factors: non-default configuration (enforced 2FA must be enabled), prior possession of a valid password, and affected versions limited to Umami 3.3.x, 3.4.0 and 3.4.1.

This is a moderate, not critical, issue and the signals are internally consistent at that level. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores 5.3 (Medium): network-reachable, low complexity, but requiring some privilege (PR:L) and yielding only low impact to confidentiality, integrity and availability. CWE-308 (use of single-factor authentication) matches the description: an enforced/mandatory 2FA policy is not applied by the login handler, so a user who should be forced through a second factor can authenticate with a password alone. The E:P (Proof-of-Concept) exploit-maturity flag and the listed exploit reference indicate a public PoC reference exists, but it is not verified as working exploit code, and there is no CISA KEV listing and no EPSS score in the input - so there is no evidence of active or widespread exploitation. The vuln.today Decision label is 'this_month', i.e. a priority to remediate within the month rather than an emergency. Net: real but bounded - it only matters where enforced 2FA is actually configured and where an attacker already holds valid first-factor credentials, so it degrades a defense-in-depth control rather than granting fresh unauthenticated access. Note the input Tag 'Information Disclosure' does not match the mechanism (an authentication-enforcement bypass), which should not be read as a confirmed confidentiality-breach signal.

An Umami administrator enables an enforced/mandatory 2FA policy, but the login route in src/app/api/auth/login/route.ts fails to apply it. A remote attacker who already possesses a valid username and password (e.g. from reuse or phishing) logs in with that single factor, defeating the second factor the policy was meant to require. A public PoC reference exists but is not verified as working exploit code.