What is the CVSS score of CVE-2026-28510?

CVE-2026-28510 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

eLabFTW CVE-2026-28510

EUVD-2026-27311 MEDIUM

Authentication Bypass by Assumed-Immutable Data (CWE-302)

2026-05-05 GitHub_M

Authentication Bypass Elabftw

5.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 05, 2026 - 13:31 vuln.today

Analysis Generated

May 05, 2026 - 13:31 vuln.today

DescriptionGitHub Advisory

eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication state across authentication steps. Under certain conditions, an attacker with valid primary credentials could complete authentication with an attacker-controlled TOTP secret and bypass the additional factor. This could result in unauthorized account access. This issue is fixed in version 5.4.2.

AnalysisAI

Multi-factor authentication bypass in eLabFTW through version 5.4.1 allows attackers with valid primary credentials to complete login using an attacker-controlled TOTP secret, circumventing the second factor requirement and gaining unauthorized account access. The vulnerability stems from inconsistent MFA state preservation across authentication steps. This issue is patched in version 5.4.2.

Technical ContextAI

eLabFTW is an open-source electronic lab notebook platform written in PHP. The vulnerability exists in the LoginController.php authentication flow, specifically in the MfaHelper instantiation during the multi-factor authentication validation step. The affected code previously accepted MFA secrets from both the session (server-side state) and directly from user-supplied request parameters, creating a race condition or logic flaw where an attacker could supply their own TOTP secret if the session state was not properly initialized. The fix (commit 8b7a575) restricts MFA secret retrieval to only the session object, eliminating the fallback to user-controlled request parameters. CWE-302 (Authentication Bypass by Alternate Name) indicates the root cause is improper validation of authentication credentials or state.

RemediationAI

Vendor-released patch: eLabFTW 5.4.2. Users should upgrade immediately from version 5.4.1 or earlier to 5.4.2 or later. The patch modifies LoginController.php to retrieve the MFA secret exclusively from the session object, eliminating the code path that allowed user-supplied TOTP secrets. For users unable to upgrade immediately, compensating controls include enforcing strong password policies to reduce the likelihood of valid credential compromise, implementing account lockout policies after failed authentication attempts, and monitoring authentication logs for unusual patterns (e.g., successful logins from new IP addresses immediately after MFA prompts). However, these controls do not address the underlying MFA bypass and should only be temporary measures. Apply the patch within 7 days for production environments.