eLabFTW EUVD-2026-27311

Exploitation requires: (1) possession of valid primary credentials for a target eLabFTW account, (2) the target account must have MFA enabled, (3) the authentication session must reach a state where the MFA secret is not properly retained in the session object (allowing fallback to request parameters), and (4) the attacker must have network access to the eLabFTW login endpoint. The vulnerability is NOT exploitable against accounts without MFA enabled, nor against accounts where the session MFA state is properly maintained throughout the authentication flow. AC:H in the CVSS vector confirms that 'certain conditions' must be met-likely timing-dependent or state-dependent conditions during the brief window between primary credential validation and MFA validation.

The CVSS score of 5.9 with vector AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N indicates network-accessible exploitation with HIGH attack complexity and HIGH privilege requirements (PR:H). The contradiction between the relatively low CVSS score and the serious impact (confidentiality and integrity compromise) reflects that exploitation requires an attacker to already possess valid primary credentials. The AC:H rating suggests 'certain conditions' must align-likely specific session states or timing windows where MFA state is not properly initialized. Since PR:H is present, this is an authenticated attack where an account holder with valid credentials can escalate to full account access by bypassing their own MFA enforcement. Real-world risk is moderate: the vulnerability only affects users who have enabled MFA and exists within a narrow authentication window. For organizations where MFA adoption is high and accounts with valid credentials are relatively restricted, this represents elevated risk. For deployments with weak credential security or where MFA is not widely enabled, impact is lower. The need for valid primary credentials significantly limits the threat surface compared to unauthenticated authentication bypasses.

An attacker obtains a valid eLabFTW account credential through phishing, password spray, or credential stuffing. When logging in with the compromised credential, the attacker reaches the MFA challenge screen. If the MFA session state has not been properly initialized (a race condition or specific configuration scenario), the attacker submits their own TOTP secret value in the authentication request. The application accepts the attacker-controlled TOTP secret instead of validating against the victim's actual MFA enrollment, allowing the attacker to complete login and access the victim's account, including sensitive lab data.