EUVD-2026-21577
GHSA-8647-755q-fw9p
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionGitHub Advisory
ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication. This vulnerability is fixed in 0.112.
AnalysisAI
Remote authentication bypass in Ajenti prior to version 0.112 allows unauthenticated network attackers to circumvent two-factor authentication during a brief post-authentication window with high attack complexity. The vulnerability affects the core authentication mechanism in ajenti.plugin.core and permits attackers to gain high-confidence access to protected resources; the vendor released patched version 0.112 to resolve this issue.
Technical ContextAI
Ajenti is a lightweight web-based system administration panel that relies on its core plugin module (ajenti.plugin.core) to manage authentication and authorization. The vulnerability exists in the two-factor authentication (2FA) implementation, specifically during the transition period immediately after a user successfully authenticates with their primary credentials but before 2FA validation is fully enforced. This represents a classic authentication state machine flaw (CWE-287: Improper Authentication) where the application fails to maintain a secure intermediate state between initial authentication and secondary factor verification. The attack surface is network-accessible through the web interface, but requires precise timing or knowledge of the authentication flow to exploit the race condition or logic gap.
RemediationAI
Vendor-released patch: upgrade Ajenti to version 0.112 or later. No workarounds are documented for deployments that cannot immediately upgrade. Organizations running versions prior to 0.112 with 2FA enabled should prioritize this update. Patch availability and instructions can be confirmed via the official GitHub security advisory at https://github.com/ajenti/ajenti/security/advisories/GHSA-8647-755q-fw9p. Installation instructions for the latest version are available in the Ajenti repository and documentation.
Ajenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the command execution panel of the
Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user
Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can resu
Ajenti version version 2 contains a Insecure Permissions vulnerability in Plugins download that can result in The downlo
Unauthenticated remote code execution in Ajenti server admin panel before 2.2.13. Unauthenticated users can gain full se
Authentication bypass in Ajenti admin panel versions prior to 0.112 allows unauthenticated remote attackers to completel
Ajenti version version 2 contains a Improper Error Handling vulnerability in Login JSON request that can result in The r
Multiple cross-site scripting (XSS) vulnerabilities in the respond_error function in routing.py in Eugene Pankov Ajenti
Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today