What is the CVSS score of CVE-2026-4773?

CVE-2026-4773 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of IDM-MFA are affected by CVE-2026-4773?

Magarsus Consulting IDM-MFA versions 2025.11.27-2026.03.09 contain an authentication bypass vulnerability that allows attackers to circumvent multi-factor authentication without valid credentials,…. A patch is available.

How to fix or mitigate CVE-2026-4773?

Within 24 hours, conduct a complete inventory of IDM-MFA deployments, identify all dependent systems, and implement enhanced monitoring for authentication anomalies and failed MFA attempts. Within 7 days, deploy compensating controls including network-level rate limiting on authentication endpoints, input validation enforcement, and redundant MFA verification outside the IDM-MFA system; consider implementing a Web Application Firewall to block malformed requests. Within 30 days, establish a vendor communication channel with Magarsus Consulting for patch status updates, document an upgrade timeline for affected instances once patches become available, and evaluate alternative MFA solutions as contingency given the current absence of vendor patches.

IDM-MFA CVE-2026-4773

EUVD-2026-47654 HIGH

Improper Validation of Specified Type of Input (CWE-1287)

2026-07-22 iletisim@usom.gov.tr

GHSA-6hcr-c36r-573w

Authentication Bypass

8.1

CVSS 3.1 · Vendor: usom

Severity by source

Vendor (usom) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated MFA bypass with low complexity but requiring user interaction (UI:R); high confidentiality/integrity from session takeover, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (usom).

CVSS VectorVendor: usom

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 22, 2026 - 16:18 EUVD

Analysis Generated

Jul 22, 2026 - 12:31 vuln.today

CVE Published

Jul 22, 2026 - 12:18 nvd

HIGH 8.1

DescriptionCVE.org

Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass.

This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10.

AnalysisAI

Authentication bypass in Magarsus Consulting IDM-MFA (versions 2025.11.27 up to but not including 2026.03.10) lets remote unauthenticated attackers circumvent multi-factor authentication by supplying improperly-typed input that the application fails to validate. Because IDM-MFA is itself an identity and MFA gateway, a successful bypass undermines the primary control protecting downstream systems, yielding high confidentiality and integrity impact. Exploitation requires some victim interaction (CVSS UI:R), and there is no public exploit identified at time of analysis.

Technical ContextAI

IDM-MFA is an identity management and multi-factor authentication product from the Turkish vendor Magarsus Consulting Ltd. Co., typically deployed as an authentication gateway/broker in front of protected applications. The root cause is CWE-1287 (Improper Validation of Specified Type of Input): the application accepts input whose declared or actual type differs from what the authentication logic assumes, and does not enforce the expected type before making a security decision. Such type-confusion or type-coercion flaws commonly manifest where serialized data, JSON/parameter values, or token fields are parsed - an attacker submits a value of an unexpected type (e.g., an array, boolean, or object where a string is expected) that coerces the validation routine into treating an unauthenticated request as authenticated, defeating the MFA check.

RemediationAI

Upgrade IDM-MFA to version 2026.03.10 or later, which is the first fixed release per the affected-version range (Vendor-released patch: 2026.03.10). Consult the USOM advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0607 and confirm the fixed build with Magarsus Consulting before deploying. Until patched, reduce exposure by restricting network reachability of the IDM-MFA authentication endpoints to trusted networks or VPN, placing a WAF or reverse proxy in front to reject requests whose parameter types deviate from expected (e.g., array/object values where scalars are required), and increasing monitoring for anomalous authentication successes that skip the MFA step; because the flaw requires user interaction, user awareness against links prompting re-authentication also lowers risk, though these controls do not fully substitute for the fix.